CVE-2026-53654

Grav prior to 3.8.5 in the Login plugin twofa_cancel task accepts a client-controlled _redirect field without a nonce and allows an unauthenticated request to set an external http, https, or protocol-relative Location target. Controller::execute() applies the field when taskTwofa_cancel() sets no redirect, and Grav::getRedirectResponse() accepts the target through Uri::isExternal(), enabling phishing redirects from a trusted Grav host.

An attacker can use a trusted Grav host to redirect users to malicious sites, potentially leading to credential theft or malware installation.

Update Grav to version 3.8.5 or later and consider adding validation of redirect fields in the application.