The Grav API plugin is vulnerable to an open redirect flaw introduced by a sanitization bypass. The SsoController::sanitizeReturnTo() routine rejects a literal ‘//’ prefix but fails to account for browsers mapping backslashes into forward slashes in HTTP and HTTPS URLs. Consequently a returnTo value such as ‘/\evil.com’ is accepted, and when the browser resolves it becomes the protocol‑relative URL ‘//evil.com’. This flaw can be triggered after a legitimate OAuth login flow, allowing an attacker known returnTo parameter to redirect an authenticated user to a malicious site for post‑login phishing. The vulnerability is therefore an instance of CWE‑601 – open redirect— and poses a loss of user trust and potential credential theft if a user follows the malicious link.

The affected vendor is Grav (getgrav), specifically the Grav API plugin bundled with Grav 2.0’s admin‑next/API stack. All releases before version 1.0.14 contain the flaw; the CPE identifier is cpe:2.3:a:getgrav:grav:*:*:*:*:*:*:*:*, indicating that the entire Grav package is impacted until the 1.0.14 update is applied.

The CVSS score of 8.6 indicates a high‑severity vulnerability, but the EPSS score is currently unavailable, so the immediate likelihood of exploitation is unclear. The issue is not listed in the CISA KEV catalog. Exploitability requires the victim to authenticate via the normal OAuth flow and then be redirected by the app’s client‑side oauth‑callback handler, so the attack is browser‑centric and relies on the user interacting with the redirect. Attackers can craft a malicious returnTo value that bypasses the server‑side guard, causing browsers to navigate to an attacker‑controlled domain after login. Because the exploitation is driven entirely by client processing, it is readily reproducible without privileged access to the server.