CVE-2026-53654 Grav: Unauthenticated open redirect via login twofa_cancel _redirect
Unauthenticated attackers can redirect users to malicious external sites via the Grav Login plugin's two-factor authentication cancellation task.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-53654?
CVE-2026-53654 is a medium-severity vulnerability in getgrav grav, published on 19 Aug 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Grav is a file-based Web platform. Prior to 3.8.5, the Login plugin twofa_cancel task accepts a client-controlled _redirect field without a nonce and allows an unauthenticated request to set an external http, https, or protocol-relative Location target. Controller::execute() applies the field when taskTwofa_cancel() sets no redirect, and Grav::getRedirectResponse() accepts the target through Uri::isExternal(), enabling phishing redirects from a trusted Grav host. This issue is fixed in version 3.8.5.
Weakness: CWE-601
Which versions are affected by CVE-2026-53654?
How do I fix CVE-2026-53654?
No fix has been published for CVE-2026-53654 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-53654 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-53654 exists.
Sources
Also known as GHSA-wwcc-xxhc-44j6.