CVE-2026-75833: Grav API Plugin Open Redirect Vulnerability

CVE-2026-75833 Overview

CVE-2026-75833 is an open redirect vulnerability [CWE-601] in the Grav API plugin (getgrav/grav-plugin-api) bundled with Grav 2.0's admin-next/API stack. Versions before 1.0.14 contain a flawed sanitization routine in SsoController::sanitizeReturnTo(). The function rejects a literal // prefix but fails to account for browser normalization of backslashes to forward slashes in special (http/https) schemes. An attacker who supplies a returnTo value such as /\evil.com bypasses the guard, and the browser later resolves it as the protocol-relative URL //evil.com.

Critical Impact
Following a legitimate OAuth login flow, an attacker can redirect an authenticated victim to an attacker-controlled site for post-login phishing and credential harvesting.

Affected Products

Grav API plugin (getgrav/grav-plugin-api) versions before 1.0.14
Grav 2.0 admin-next/API stack (bundled component)
Deployments exposing the SSO/OAuth callback flow via the API plugin

Discovery Timeline

2026-08-18 - CVE-2026-75833 published to the National Vulnerability Database (NVD)
2026-08-18 - Last updated in NVD database

Technical Details for CVE-2026-75833

Vulnerability Analysis

The vulnerability lives in SsoController::sanitizeReturnTo(), the routine responsible for validating the returnTo parameter used after a successful OAuth authentication. The sanitizer rejects values that begin with the protocol-relative prefix //, which would otherwise let a browser interpret the target as an external origin.

The check does not normalize backslashes before comparison. Modern browsers, when parsing URLs in special schemes such as http and https, treat \ as equivalent to /. A value like /\evil.com therefore passes server-side validation as an apparent same-origin path but is resolved by the client as //evil.com, producing a cross-origin redirect.

Exploitation requires user interaction (UI:P) and low privileges (PR:L), meaning an authenticated user must follow a crafted OAuth link. Full browser-side exploitability depends on how the admin-next single-page application's oauth-callback handler consumes the returnTo value, and this end-to-end path was not independently verified by the reporter. See the GitHub Security Advisory GHSA-x72c-4jc4-8rh6 for maintainer detail.

Root Cause

The sanitizer performs string-prefix matching on the untransformed input. It does not canonicalize the URL or reject backslash characters, so it fails to recognize \ as a slash-equivalent when the value is later parsed by a browser in a special scheme.

Attack Vector

An attacker crafts an OAuth authorization URL against a target Grav site with returnTo=/\evil.com (or a similar backslash-prefixed value). After the victim completes legitimate SSO authentication, the client-side callback redirects the browser to //evil.com. The attacker hosts a spoofed Grav or admin login page and captures credentials, session tokens, or additional OAuth grants. See the Vulncheck advisory for Grav API for further attack context.

Detection Methods for CVE-2026-75833

Indicators of Compromise

HTTP requests to the Grav SSO/OAuth callback endpoint containing returnTo parameters with a backslash character (\), URL-encoded as %5C, immediately following the leading slash.
Outbound browser redirects from authenticated admin sessions to unexpected external hosts shortly after successful OAuth completion.
Referer headers on external domains that originate from the Grav admin/API OAuth callback URL.

Detection Strategies

Inspect web server and reverse proxy logs for returnTo values matching the pattern ^/[\\%5C] on any Grav API plugin endpoint.
Alert on OAuth callback requests where the resolved returnTo destination host does not match the Grav site's own origin allow-list.
Deploy a Web Application Firewall (WAF) rule to flag or block requests carrying backslashes in redirect-style query parameters.

Monitoring Recommendations

Centralize Grav access logs and OAuth callback events for retrospective search on the returnTo parameter.
Correlate authenticated admin sessions with subsequent DNS lookups or proxy egress to newly observed domains within a short time window.
Track the installed version of getgrav/grav-plugin-api across all Grav instances and alert on versions below 1.0.14.

How to Mitigate CVE-2026-75833

Immediate Actions Required

Upgrade the Grav API plugin to version 1.0.14 or later on every Grav 2.0 admin-next deployment.
Audit recent OAuth callback logs for returnTo values containing \ or %5C and identify potentially phished users.
Force re-authentication and rotate any SSO/OAuth tokens for accounts that followed suspicious login links since deployment.

Patch Information

The maintainers fixed SsoController::sanitizeReturnTo() in getgrav/grav-plugin-api version 1.0.14. The corrected sanitizer normalizes backslashes and rejects any returnTo value that resolves to a non-local origin. Refer to the GitHub Security Advisory GHSA-x72c-4jc4-8rh6 for the authoritative fix reference.

Workarounds

If immediate patching is not possible, restrict access to the Grav admin/API OAuth endpoints to trusted networks or VPN clients.
Add a WAF rule that blocks requests containing \ or %5C in the returnTo parameter on Grav SSO routes.
Configure a strict server-side allow-list of permitted post-login redirect paths and drop any request whose returnTo does not match.

bash

# Example WAF/nginx guard rejecting backslash-prefixed returnTo values
if ($arg_returnTo ~* "^(/|%2F)?(\\|%5C)") {
    return 400;
}