CVE-2026-75833 getgrav CVE debrief

Who should care

Defenders and administrators of Grav 2.0 installations with the admin-next/API stack should assess exposure and prioritize updating the Grav API plugin to prevent potential phishing attacks.

Why it matters

The open redirect weakness in the Grav API plugin allows for potential post-login phishing attacks, requiring defenders to verify and update plugin versions, implement additional security measures, and monitor for suspicious activity.

• Potential for post-login phishing attacks
• Need for verification of Grav API plugin versions
• Possible impact on authenticated users
• Requirement for additional security measures

Technical summary

The Grav API plugin (getgrav/grav-plugin-api) before version 1.0.14 contains an open redirect weakness in SsoController::sanitizeReturnTo(). The function rejects a literal '//' prefix but does not account for browsers normalizing backslashes to slashes in special (http/https) schemes, allowing an attacker-supplied returnTo parameter to potentially redirect an authenticated victim to an attacker-controlled site for post-login phishing following a legitimate OAuth login flow. Defenders should prioritize verifying and updating Grav API plugin versions to prevent potential phishing attacks.

Defensive priority

Defenders should prioritize verifying and updating Grav API plugin versions to prevent potential phishing attacks.

Recommended defensive actions

• Verify and update Grav API plugin versions to 1.0.14 or later
• Implement additional security measures to prevent phishing attacks
• Monitor for suspicious activity and update incident response plans
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the open redirect weakness in the Grav API plugin. However, full browser-side exploitability depends on the admin-next SPA's client-side oauth-callback handler and was not independently verified by the reporter.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.