Phishing redirect via unchecked _redirect field

Open redirect in the Login plugin in Grav before 3.8.5 allows remote attackers to redirect users to arbitrary sites via the _redirect parameter. Controller::execute() applied a client-supplied _redirect when no task set its own redirect, and taskTwofa_cancel previously returned without setting one while the login controller did not require a login-form nonce for that task. Exploitation is remote and unauthenticated but requires a crafted POST request and user follow-through on the trusted-host redirect, so the consequence is phishing exposure rather than direct server compromise.