{"id":"CVE-2026-53573","aliases":["GHSA-pjp7-q6wp-97qx"],"url":"https://o3.security/vulnerability/CVE-2026-53573","summary":"core-geonetwork has an Open Redirect Bypass","details":"GeoNetwork is a catalog application to manage spatially referenced resources. From 3.12.0 until 4.2.16 and 4.4.11, unsafe redirect validation in GeonetworkOAuth2LoginAuthenticationFilter and KeycloakAuthenticationProcessingFilter permits an attacker-controlled external redirect after login. This issue is fixed in versions 4.2.16 and 4.4.11.","published":"2026-07-31T22:16:25.110Z","modified":"2026-09-12T08:08:22.233150Z","cvss":null,"epss":{"score":0.00377,"percentile":0.31218,"asOf":"2026-09-15"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Maven","name":"org.geonetwork-opensource:geonetwork","fixedVersion":null},{"ecosystem":"Maven","name":"org.geonetwork-opensource:geonetwork","fixedVersion":null},{"ecosystem":"Maven","name":"org.geonetwork-opensource:geonetwork","fixedVersion":"4.2.16"},{"ecosystem":"Maven","name":"org.geonetwork-opensource:geonetwork","fixedVersion":"4.4.11"}],"fix":{"url":"https://github.com/geonetwork/core-geonetwork/commit/0d74f673dfc926bde935819ed34636d789b2fecd","label":"geonetwork/core-geonetwork@0d74f67"},"references":[{"type":"WEB","url":"https://github.com/geonetwork/core-geonetwork/releases/tag/4.2.16"},{"type":"WEB","url":"https://github.com/geonetwork/core-geonetwork/releases/tag/4.4.11"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53573.json"},{"type":"ADVISORY","url":"https://github.com/geonetwork/core-geonetwork/security/advisories/GHSA-pjp7-q6wp-97qx"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53573"},{"type":"FIX","url":"https://github.com/geonetwork/core-geonetwork/commit/0d74f673dfc926bde935819ed34636d789b2fecd"},{"type":"FIX","url":"https://github.com/geonetwork/core-geonetwork/commit/cde9b6481a29e2473b7b74479b4e3fd6843bac4e"},{"type":"FIX","url":"https://github.com/geonetwork/core-geonetwork/pull/9307"},{"type":"FIX","url":"https://github.com/geonetwork/core-geonetwork/pull/9309"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-09-12T08:08:22.233150Z"}}