GeoNetwork OAuth2/OIDC/Keycloak Login Filter Open Redirect Vulnerability (CVE-2026-53573)

Vulnerability Overview Vulnerability Name: Open Redirect Bypass in core-geonetwork OAuth2/OIDC and Keycloak login filters Description: The login redirect handling in GeoNetwork can be bypassed to redirect users to attacker-controlled websites, even when the code attempts to restrict redirect targets to relative, in-app URLs. This affects two SSO login methods: OAuth2/OIDC and Keycloak. Scope of Impact Affected Versions: - (Maven) - >= 3.12.0, = 4.0.0-alpha.1, = 4.2.0, = 4.4.0, < 4.4.10 Severity: Low (CVSS v3 base metrics: Attack vector: Network, Attack complexity: Low, Privileges required: None, User interaction: None, Scope: Unchanged, Confidentiality: None, Integrity: None, Availability: None) CVE ID: CVE-2026-53573 Weakness: CWE-601 Remediation Fixed Versions: - 3.12.12 - 4.0.6 - 4.2.15 - 4.4.10 Recommendation: Upgrade to one of the above supported versions (4.2.15 or 4.4.10 or higher). Additional Information Summary: The login redirect handling in GeoNetwork can be bypassed to redirect users to attacker-controlled websites, even when the code attempts to restrict redirect targets to relative, in-app URLs. This affects two SSO login methods: OAuth2/OIDC and Keycloak. Details: The OAuth2/OIDC and Keycloak login filters validate the login redirect target provided by the client before forwarding the browser to it. However, the validation does not correctly reject every type of URL, allowing the browser to leave the GeoNetwork origin. Consequently, relative paths considered safe can still result in the browser being redirected to an external, attacker-controlled website. Impact: An attacker can construct a link to a legitimate GeoNetwork OAuth2/OIDC or Keycloak login endpoint, which will redirect the victim to an arbitrary external website after the login process completes. This can be used for phishing (e.g., presenting a fake login form) or chained within other attacks. This vulnerability does not bypass authentication or expose GeoNetwork data; the impact is an open redirect (CWE-601). Note: GeoNetwork 3.x and 4.0.x are archived/out of maintenance and will not receive fixes for this issue. Users running these instances should upgrade to supported versions (4.2.15 or 4.4.10 or higher). Code Blocks No POC code or exploitation code is included in the page.

Goal Reached Thanks to every supporter — we hit 100%!

GeoNetwork OAuth2/OIDC/Keycloak Login Filter Open Redirect Vulnerability (CVE-2026-53573)

More from this source