VULNERABILITY INTELLIGENCE
CVE-2026-53654
EPSS probability0.53%
CISA KEVNot currently listed
Published2026-08-19
Last modified2026-09-09
Description
Grav is a file-based Web platform. Prior to 3.8.5, the Login plugin twofa_cancel task accepts a client-controlled _redirect field without a nonce and allows an unauthenticated request to set an external http, https, or protocol-relative Location target. Controller::execute() applies the field when taskTwofa_cancel() sets no redirect, and Grav::getRedirectResponse() accepts the target through Uri::isExternal(), enabling phishing redirects from a trusted Grav host. This issue is fixed in version 3.8.5.
Weakness classification
- security-advisories@github.com: CWE-601