{"id":"CVE-2026-53573","aliases":["GHSA-pjp7-q6wp-97qx"],"url":"https://o3.security/vulnerability/CVE-2026-53573","summary":"core-geonetwork has an Open Redirect Bypass","details":"### Summary\nGeoNetwork's post-login redirect handling can be bypassed to redirect users to an attacker-controlled external site, even though the code attempts to restrict redirect targets to relative, in-application URLs. This affects both supported SSO login methods: OAuth2/OIDC and Keycloak.\n\n### Details\nBoth the OAuth2/OIDC and Keycloak login filters validate the client-supplied post-login redirect target before forwarding the browser to it, but the validation does not correctly reject every kind of URL that causes the browser to leave the GeoNetwork origin. As a result, a value that is treated as a safe, in-application relative path by the filter can still cause the browser to be redirected to an external, attacker-controlled host.\n\n### Impact\nAn attacker can craft a link to a legitimate GeoNetwork OAuth2/OIDC or Keycloak login endpoint that, after the login flow completes, redirects the victim to an arbitrary external site. This can be used for phishing (e.g., presenting a fake login form) or to chain into other attacks hosted externally. This does not bypass authentication or expose GeoNetwork data directly; the impact is Open Redirect (CWE-601).\n\nGeoNetwork 3.x and 4.0.x are archived/unmaintained and will not receive a fix for this issue. Instances running those lines should upgrade to a supported release (4.2.16 or later, or 4.4.11 or later).","published":"2026-07-31T22:16:25.110Z","modified":"2026-10-28T11:16:58.074240540Z","cvss":null,"epss":{"score":0.00377,"percentile":0.31371,"asOf":"2026-09-16"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Maven","name":"org.geonetwork-opensource:geonetwork","fixedVersion":null},{"ecosystem":"Maven","name":"org.geonetwork-opensource:geonetwork","fixedVersion":null},{"ecosystem":"Maven","name":"org.geonetwork-opensource:geonetwork","fixedVersion":"4.2.16"},{"ecosystem":"Maven","name":"org.geonetwork-opensource:geonetwork","fixedVersion":"4.4.11"}],"fix":{"url":"https://github.com/geonetwork/core-geonetwork/commit/0d74f673dfc926bde935819ed34636d789b2fecd","label":"geonetwork/core-geonetwork@0d74f67"},"references":[{"type":"WEB","url":"https://github.com/geonetwork/core-geonetwork/releases/tag/4.2.16"},{"type":"WEB","url":"https://github.com/geonetwork/core-geonetwork/releases/tag/4.4.11"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53573.json"},{"type":"ADVISORY","url":"https://github.com/geonetwork/core-geonetwork/security/advisories/GHSA-pjp7-q6wp-97qx"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53573"},{"type":"FIX","url":"https://github.com/geonetwork/core-geonetwork/commit/0d74f673dfc926bde935819ed34636d789b2fecd"},{"type":"FIX","url":"https://github.com/geonetwork/core-geonetwork/commit/cde9b6481a29e2473b7b74479b4e3fd6843bac4e"},{"type":"FIX","url":"https://github.com/geonetwork/core-geonetwork/pull/9307"},{"type":"FIX","url":"https://github.com/geonetwork/core-geonetwork/pull/9309"},{"type":"PACKAGE","url":"https://github.com/geonetwork/core-geonetwork"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-28T11:16:58.074240540Z"}}