Grav CMS versions prior to 3.8.5 contain an open redirect vulnerability (CWE-601) in the Login plugin's twofa_cancel task. The plugin accepts a client-controlled _redirect parameter without verifying a nonce, allowing unauthenticated requests to specify an external URL for redirection. The Controller::execute() method applies this redirect when taskTwofa_cancel() does not set a redirect, and Grav::getRedirectResponse() accepts the external target via Uri::isExternal(). This flaw enables attackers to redirect users from a trusted Grav host to arbitrary external sites, facilitating phishing attacks. The vulnerability is resolved in version 3.8.5.

An attacker can exploit this vulnerability to redirect users from a trusted Grav site to an attacker-controlled external URL without authentication. This can be used in phishing campaigns to trick users into visiting malicious sites. There is no direct impact on confidentiality, integrity, or availability of the Grav system itself, but the open redirect can facilitate social engineering attacks.

This vulnerability is fixed in Grav version 3.8.5. Users should upgrade to version 3.8.5 or later to remediate the issue. No other mitigations are specified or required once the update is applied.