{"uuid": "b43805ab-0ac8-49e8-9970-1093778902b8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-53573", "type": "seen", "source": "https://gist.github.com/alon710/32cccaf1dfa9c1c40b850f71e29f1c0f", "content": "# CVE-2026-53573: CVE-2026-53573: Open Redirect Bypass in GeoNetwork OAuth2/OIDC and Keycloak Login Filters\n\n> **CVSS Score:** 4.8\n> **Published:** 2026-07-31\n> **Full Report:** https://cvereports.com/reports/CVE-2026-53573\n\n## Summary\nAn open redirect vulnerability exists in core-geonetwork from versions 3.12.0 until 4.2.16 and 4.4.11 due to unsafe redirect validation in GeonetworkOAuth2LoginAuthenticationFilter and KeycloakAuthenticationProcessingFilter. An attacker can construct a protocol-relative URL to bypass local redirection checks and redirect authenticated users to malicious external domains.\n\n## TL;DR\nGeoNetwork post-login and post-logout filters fail to prevent protocol-relative redirects, allowing attackers to bypass validation using double-slash syntax and redirect users to external phishing sites.\n\n## Technical Details\n\n- **CWE ID**: CWE-601\n- **Attack Vector**: Network\n- **CVSS Score**: 4.8\n- **Exploit Status**: None\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- GeoNetwork core-geonetwork\n- **core-geonetwork**: >= 3.12.0, <= 3.12.12 (Fixed in: `4.2.16`)\n- **core-geonetwork**: >= 4.0.0-alpha.1, <= 4.0.6 (Fixed in: `4.2.16`)\n- **core-geonetwork**: >= 4.2.0, < 4.2.16 (Fixed in: `4.2.16`)\n- **core-geonetwork**: >= 4.4.0, < 4.4.11 (Fixed in: `4.4.11`)\n\n## Mitigation\n\n- Implement centralized redirect validation using RedirectUtil to prevent double-slash bypasses.\n- Deploy Web Application Firewall (WAF) rules to drop requests with protocol-relative URL parameters.\n- Enforce strict Content Security Policies (CSP) to restrict navigation and form targets.\n\n**Remediation Steps:**\n1. Upgrade GeoNetwork deployment to version 4.2.16, 4.4.11, or later.\n2. Verify that custom authentication filters rely on RedirectUtil for redirection validation.\n3. Inspect configuration XML files to ensure GeonetworkSavedRequestAwareAuthenticationSuccessHandler is configured.\n\n## References\n\n- [Official GitHub Advisory](https://github.com/geonetwork/core-geonetwork/security/advisories/GHSA-pjp7-q6wp-97qx)\n- [National Vulnerability Database Entry](https://nvd.nist.gov/vuln/detail/CVE-2026-53573)\n- [CVE.org Record](https://www.cve.org/CVERecord?id=CVE-2026-53573)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-53573) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-01T02:31:13.506220Z"}