https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 08:59:55 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-354931 EUVD-2026-354931 https://cve.radiocsirt.org/vuln/euvd-2026-354931 https://cve.radiocsirt.org/vuln/fkie_cve-2026-75833 <p>The Grav API plugin (getgrav/grav-plugin-api, bundled with Grav 2.0&#39;s admin-next/API stack) before version 1.0.14 contains an open redirect weakness in SsoController::sanitizeReturnTo(). The function rejects a literal &#39;//&#39; prefix but does not account for browsers normalizing backslashes to slashes in special (http/https) schemes, so a returnTo value such as &#39;/\evil.com&#39; passes the guard and is later resolved by the browser as the protocol-relative URL &#39;//evil.com&#39;. Following a legitimate OAuth login flow, an attacker-supplied returnTo parameter could redirect an authenticated victim to an attacker-controlled site for post-login phishing. Full browser-side exploitability depends on the admin-next SPA&#39;s client-side oauth-callback handler and was not independently verified by the reporter.</p> <p>The Grav API plugin (getgrav/grav-plugin-api, bundled with Grav 2.0&#39;s admin-next/API stack) before version 1.0.14 contains an open redirect weakness in SsoController::sanitizeReturnTo(). The function rejects a literal &#39;//&#39; prefix but does not account for browsers normalizing backslashes to slashes in special (http/https) schemes, so a returnTo value such as &#39;/\evil.com&#39; passes the guard and is later resolved by the browser as the protocol-relative URL &#39;//evil.com&#39;. Following a legitimate OAuth login flow, an attacker-supplied returnTo parameter could redirect an authenticated victim to an attacker-controlled site for post-login phishing. Full browser-side exploitability depends on the admin-next SPA&#39;s client-side oauth-callback handler and was not independently verified by the reporter.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-75833 https://cve.radiocsirt.org/vuln/ghsa-chr5-7vjc-3p97 <p>The Grav API plugin (getgrav/grav-plugin-api, bundled with Grav 2.0&#39;s admin-next/API stack) before version 1.0.14 contains an open redirect weakness in SsoController::sanitizeReturnTo(). The function rejects a literal &#39;//&#39; prefix but does not account for browsers normalizing backslashes to slashes in special (http/https) schemes, so a returnTo value such as &#39;/\evil.com&#39; passes the guard and is later resolved by the browser as the protocol-relative URL &#39;//evil.com&#39;. Following a legitimate OAuth login flow, an attacker-supplied returnTo parameter could redirect an authenticated victim to an attacker-controlled site for post-login phishing. Full browser-side exploitability depends on the admin-next SPA&#39;s client-side oauth-callback handler and was not independently verified by the reporter.</p> <p>The Grav API plugin (getgrav/grav-plugin-api, bundled with Grav 2.0&#39;s admin-next/API stack) before version 1.0.14 contains an open redirect weakness in SsoController::sanitizeReturnTo(). The function rejects a literal &#39;//&#39; prefix but does not account for browsers normalizing backslashes to slashes in special (http/https) schemes, so a returnTo value such as &#39;/\evil.com&#39; passes the guard and is later resolved by the browser as the protocol-relative URL &#39;//evil.com&#39;. Following a legitimate OAuth login flow, an attacker-supplied returnTo parameter could redirect an authenticated victim to an attacker-controlled site for post-login phishing. Full browser-side exploitability depends on the admin-next SPA&#39;s client-side oauth-callback handler and was not independently verified by the reporter.</p> https://cve.radiocsirt.org/vuln/ghsa-chr5-7vjc-3p97