CVE-2026-53573: Open Redirect Bypass in GeoNetwork OAuth2/OIDC and Keycloak Login Filters
Vulnerability ID: CVE-2026-53573
CVSS Score: 4.8
Published: 2026-07-31
An open redirect vulnerability exists in core-geonetwork from versions 3.12.0 until 4.2.16 and 4.4.11 due to unsafe redirect validation in GeonetworkOAuth2LoginAuthenticationFilter and KeycloakAuthenticationProcessingFilter. An attacker can construct a protocol-relative URL to bypass local redirection checks and redirect authenticated users to malicious external domains.
TL;DR
GeoNetwork post-login and post-logout filters fail to prevent protocol-relative redirects, allowing attackers to bypass validation using double-slash syntax and redirect users to external phishing sites.
Technical Details
- CWE ID: CWE-601
- Attack Vector: Network
- CVSS Score: 4.8
- Exploit Status: None
- KEV Status: Not Listed
Affected Systems
- GeoNetwork core-geonetwork
-
core-geonetwork: >= 3.12.0, <= 3.12.12 (Fixed in:
4.2.16) -
core-geonetwork: >= 4.0.0-alpha.1, <= 4.0.6 (Fixed in:
4.2.16) -
core-geonetwork: >= 4.2.0, < 4.2.16 (Fixed in:
4.2.16) -
core-geonetwork: >= 4.4.0, < 4.4.11 (Fixed in:
4.4.11)
Code Analysis
Commit: cde9b64
Implement RedirectUtil to safely validate login and logout redirects on main branch.
Commit: 0d74f67
Backport of RedirectUtil implementation to support secure redirect logic.
Mitigation Strategies
- Implement centralized redirect validation using RedirectUtil to prevent double-slash bypasses.
- Deploy Web Application Firewall (WAF) rules to drop requests with protocol-relative URL parameters.
- Enforce strict Content Security Policies (CSP) to restrict navigation and form targets.
Remediation Steps:
- Upgrade GeoNetwork deployment to version 4.2.16, 4.4.11, or later.
- Verify that custom authentication filters rely on RedirectUtil for redirection validation.
- Inspect configuration XML files to ensure GeonetworkSavedRequestAwareAuthenticationSuccessHandler is configured.
References
Read the full report for CVE-2026-53573 on our website for more details including interactive diagrams and full exploit analysis.
Top comments (0)