The Grav API plugin (getgrav/grav-plugin-api) before version 1.0.14 contains an open redirect vulnerability in the SsoController::sanitizeReturnTo() method. The method rejects returnTo parameters starting with '//' but does not consider that browsers normalize backslashes to slashes in URLs with http/https schemes. An attacker can supply a returnTo value such as '/\evil.com' which bypasses the check and is interpreted by browsers as a protocol-relative URL '//evil.com'. After a legitimate OAuth login, this can redirect authenticated users to attacker-controlled sites, facilitating phishing attacks. The full exploitability depends on the behavior of the admin-next SPA's client-side OAuth callback handler, which was not independently verified by the reporter.

An attacker can craft a malicious returnTo parameter that causes an authenticated user to be redirected to an attacker-controlled website after OAuth login. This can be used for post-login phishing attacks, potentially compromising user trust and credentials. The vulnerability requires user interaction and depends on the client-side OAuth callback handler's behavior. There are no known exploits in the wild.

A fix is available in version 1.0.14 of the Grav API plugin. Users should upgrade to version 1.0.14 or later to remediate this open redirect vulnerability. Until then, avoid using untrusted input for returnTo parameters in OAuth flows.