CVE-2026-75833

Name of the Vulnerable Software and Affected Versions Grav API plugin versions prior to 1.0.14

Description An open redirect weakness exists in the SsoController::sanitizeReturnTo() function. The function fails to account for browsers that normalize backslashes to slashes in http or https schemes. Consequently, a returnTo value containing a backslash, such as /evil.com, can bypass the security guard and be interpreted by the browser as a protocol-relative URL. This allows an attacker to use the returnTo parameter during a legitimate OAuth login flow to redirect an authenticated user to a malicious site for phishing purposes.

Recommendations Update Grav API plugin to version 1.0.14 or later.