CVE-2026-53683— Freeipa: idm: idm/freeipa web ui - client-side open redirect in reset_password.html
Quick assessment
Affected
Red Hat Red Hat Enterprise Linux 10
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
FreeIPA是FreeIPA组织开源的一款身份认证与权限管理产品。 FreeIPA存在安全漏洞，该漏洞源于reset_password.html在密码重置后未对url参数进行验证或白名单校验，可能将用户重定向到任意外部站点。
Possible ATT&CK Techniques 3 AI
T1566 · Phishing T1566.001 · Spearphishing Attachment T1566.002 · Spearphishing LinkAffected Version Matrix 7
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | any |
affected |
| Red Hat | Red Hat Enterprise Linux 6 | any |
unknown |
| Red Hat | Red Hat Enterprise Linux 7 | any |
affected |
| Red Hat | Red Hat Enterprise Linux 8 | any |
affected |
any |
affected | ||
any |
affected | ||
| Red Hat | Red Hat Enterprise Linux 9 | any |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-53683
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Freeipa: idm: idm/freeipa web ui - client-side open redirect in reset_password.html
Source: CVE Program / CVE List V5
Vulnerability Description
reset_password.html parses query string parameters and uses the 'url' parameter as a redirection target (window.location = url) after password reset, optionally delayed by a 'delay' parameter. No validation or allowlisting is performed on url, enabling an attacker to redirect users to an arbitrary external site after completion of the password-reset workflow.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
指向未可信站点的URL重定向(开放重定向)
Source: CVE Program / CVE List V5
Vulnerability Title
FreeIPA 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
FreeIPA是FreeIPA组织开源的一款身份认证与权限管理产品。 FreeIPA存在安全漏洞，该漏洞源于reset_password.html在密码重置后未对url参数进行验证或白名单校验，可能将用户重定向到任意外部站点。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | - |
cpe:/o:redhat:enterprise_linux:10
|
|
| Red Hat | Red Hat Enterprise Linux 6 | - |
cpe:/o:redhat:enterprise_linux:6
|
|
| Red Hat | Red Hat Enterprise Linux 7 | - |
cpe:/o:redhat:enterprise_linux:7
|
|
| Red Hat | Red Hat Enterprise Linux 8 | - |
cpe:/o:redhat:enterprise_linux:8
|
|
| Red Hat | Red Hat Enterprise Linux 8 | - |
cpe:/o:redhat:enterprise_linux:8
|
|
| Red Hat | Red Hat Enterprise Linux 8 | - |
cpe:/o:redhat:enterprise_linux:8
|
|
| Red Hat | Red Hat Enterprise Linux 9 | - |
cpe:/o:redhat:enterprise_linux:9
|
|
II. Public POCs for CVE-2026-53683
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-53683
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-53683 (2)
Same Patch Batch · Red Hat · 2026-09-02 · 8 CVEs total
| CVE-2026-66786 | 9.1 CRITICAL | Submariner: submariner: ipsec.conf stanza injection via remote-supplied cablename and subn |
| CVE-2026-78408 | 7.9 HIGH | Util-linux: util-linux: nsenter --join-cgroup leaks root cgroup migration authority |
| CVE-2026-84838 | 7.8 HIGH | Rpm: command injection in rpmuncompress via unescaped filenames passed to popen() |
| CVE-2026-84837 | 7.8 HIGH | Rpm: command injection in `rpmbuild -t*` (`gettarspec`) via unescaped tarball path |
| CVE-2026-78410 | 7.8 HIGH | Util-linux: util-linux: restricted bind mounts do not pin the source, allowing x-mount.own |
| CVE-2026-78409 | 7.0 HIGH | Util-linux: util-linux: x-mount.subdir detached-tree resolution can escape via intermediat |
| CVE-2026-82968 | 6.4 MEDIUM | Keycloak-services: keycloak-services: cross-session email verification proof not bound to |
IV. Related Vulnerabilities
Same product: Red Hat Enterprise Linux 10
-
CVE-2026-115486
Open-iscsi: open-iscsi: ipv6 neighbor discovery missing opti -
CVE-2026-115485
Open-iscsi: open-iscsi: dhcpv6 vendor option strlen heap out -
CVE-2026-115484
Open-iscsi: open-iscsi: dhcpv4 option parser heap out-of-bou -
CVE-2026-115449
Libslirp: libslirp: icmp echo reply length desynchronization -
CVE-2026-115221
Ipa: freeipa: freeipa uses subject cn as proof of certificat
Same vendor: Red Hat
-
CVE-2026-115486
Open-iscsi: open-iscsi: ipv6 neighbor discovery missing opti -
CVE-2026-115485
Open-iscsi: open-iscsi: dhcpv6 vendor option strlen heap out -
CVE-2026-115484
Open-iscsi: open-iscsi: dhcpv4 option parser heap out-of-bou -
CVE-2026-115449
Libslirp: libslirp: icmp echo reply length desynchronization -
CVE-2026-115221
Ipa: freeipa: freeipa uses subject cn as proof of certificat
Same weakness: CWE-601
-
CVE-2026-115537
gedelumbung HospitalManagement URL Validation routing_pages. -
CVE-2026-114614
Authlib: is_secure_transport() loopback exemption can be byp -
CVE-2026-115360
OpenBao before 2.6.3 Open Redirect via OIDC Identity Provide -
CVE-2026-87937
Central Authentication System (CAS) Server - Moderately crit -
CVE-2026-87945
SAML SSO - Service Provider - Critical - Open redirect - SA
V. Comments for CVE-2026-53683
No comments yet