The Grav API plugin (getgrav/grav-plugin-api) prior to version 1.0.14 contains an open redirect vulnerability in the SsoController::sanitizeReturnTo() function. The function attempts to block returnTo parameters starting with '//' but fails to consider that browsers normalize backslashes to slashes in HTTP/HTTPS schemes. An attacker can supply a returnTo value such as '/\evil.com' which bypasses the check and is resolved by browsers as a protocol-relative URL '//evil.com'. This can redirect authenticated users to attacker-controlled sites after OAuth login, enabling phishing attacks. The full exploitability depends on the admin-next SPA's client-side OAuth callback handler and has not been independently confirmed.

An attacker can redirect authenticated users to malicious sites after a legitimate OAuth login by exploiting the open redirect vulnerability. This can facilitate phishing attacks targeting users who trust the original site. There is no indication of direct code execution or data compromise from this vulnerability alone. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should monitor official getgrav communications for updates or patches addressing this issue. Until a fix is available, avoid using untrusted returnTo parameters in OAuth login flows or implement additional validation on these parameters.