---
id: CVE-2026-75833
title: >-
  The Grav API plugin (getgrav/grav-plugin-api, bundled with Grav 2.0's
  admin-next/API stack) before version 1.0.14 contains an open redirect weakness
  in SsoController::sanitizeReturnTo()
summary: >-
  The Grav API plugin (getgrav/grav-plugin-api, bundled with Grav 2.0's
  admin-next/API stack) before version 1.0.14 contains an open redirect weakness
  in SsoController::sanitizeReturnTo(). The function rejects a literal '//'
  prefix but doe…
severity: medium
cvss: 4.2
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N'
cwe:
  - CWE-601
published: '2026-08-18'
updated: '2026-09-08'
sourceUpdated: '2026-09-08T20:32:39.347'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-75833'
references:
  - url: 'https://github.com/getgrav/grav/security/advisories/GHSA-x72c-4jc4-8rh6'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/grav-api-plugin-open-redirect-via-backslash-bypass
    label: disclosure@vulncheck.com
tags:
  - nvd
epss: 0.00194
epssPercentile: 0.09374
ingestedAt: '2026-09-08T21:11:12.279Z'
---

## Overview

The Grav API plugin (getgrav/grav-plugin-api, bundled with Grav 2.0's admin-next/API stack) before version 1.0.14 contains an open redirect weakness in SsoController::sanitizeReturnTo(). The function rejects a literal '//' prefix but does not account for browsers normalizing backslashes to slashes in special (http/https) schemes, so a returnTo value such as '/\evil.com' passes the guard and is later resolved by the browser as the protocol-relative URL '//evil.com'. Following a legitimate OAuth login flow, an attacker-supplied returnTo parameter could redirect an authenticated victim to an attacker-controlled site for post-login phishing. Full browser-side exploitability depends on the admin-next SPA's client-side oauth-callback handler and was not independently verified by the reporter.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.