Grav CMS versions before 2.0.16 have an origin validation bypass vulnerability in the Uri::referrer() and Pages::referrerRoute() methods. The issue arises because these methods validate the Referer header using an unanchored prefix match without a trailing delimiter. This allows an attacker controlling a domain that starts with the victim's origin to bypass the Referer-based origin check.