The Grav form plugin versions prior to 9.1.13 contain an open redirect vulnerability (CVE-2026-69087). Since version 9.1.11, the redirect process action evaluates user-supplied form data within Twig expressions, and Grav::redirect() does not validate the origin of URLs. When a form blueprint defines a redirect target using an attacker-controllable field (e.g., redirect: "{{ form.value('next') }}"), an unauthenticated attacker can submit a form with a crafted URL such as https://evil.com, causing the application to perform a 302 redirect to that external site. This behavior enables phishing attacks by redirecting users to malicious websites.

An unauthenticated attacker can exploit this vulnerability to redirect users to arbitrary external websites by submitting specially crafted form data. This can be leveraged for phishing attacks, potentially leading to user credential theft or other malicious outcomes. The vulnerability does not require authentication and can be triggered by any form submitter.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid using user-controllable fields in redirect targets or implement strict validation to ensure redirect URLs are limited to trusted origins.