The Grav form plugin versions prior to 9.1.13 contain an open redirect vulnerability (CVE-2026-69087). Since version 9.1.11, the redirect process action evaluates user-supplied form data inside Twig expressions, and Grav::redirect() accepts external URLs without origin validation. If a form blueprint defines a redirect target using an attacker-controllable field (e.g., redirect: "{{ form.value('next') }}"), an unauthenticated attacker can submit a form with a malicious URL such as https://evil.com, causing a 302 redirect to that external site. This behavior enables phishing attacks by redirecting users to untrusted domains.

An unauthenticated attacker can exploit this vulnerability to redirect users to arbitrary external websites by submitting specially crafted form data. This can be used to facilitate phishing attacks by redirecting users to malicious sites without their consent. The vulnerability does not require authentication and has a high impact due to the ability to redirect users to untrusted domains.

A fix is available in grav-plugin-form version 9.1.13. Users should upgrade to version 9.1.13 or later to remediate this vulnerability. Until patched, avoid using user-controllable fields in redirect targets or implement strict validation of redirect URLs to ensure they point only to trusted origins.