CVE-2026-53573

Received Received - Intake

Unsafe Redirect Validation in GeoNetwork

Publication date: 2026-07-31

Last updated on: 2026-07-31

Assigner: GitHub, Inc.

Description

GeoNetwork is a catalog application to manage spatially referenced resources. From 3.12.0 until 4.2.16 and 4.4.11, unsafe redirect validation in GeonetworkOAuth2LoginAuthenticationFilter and KeycloakAuthenticationProcessingFilter permits an attacker-controlled external redirect after login. This issue is fixed in versions 4.2.16 and 4.4.11.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-31

Last Modified

2026-07-31

Generated

2026-08-01

AI Q&A

2026-08-01

EPSS Evaluated

N/A

NVD

CVE-2026-53573

Affected Vendors & Products

Vendor	Product	Version / Range
geonetwork	geonetwork	From 3.12.0 (inc) to 4.2.16 (inc)
geonetwork	geonetwork	to 4.4.11 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-601	The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.

Attack-Flow Graph

Executive Summary

This vulnerability involves unsafe redirect validation in GeoNetwork's OAuth2 and Keycloak login filters. It allows an attacker to manipulate the redirect URL after login to point to an external site under their control. The flaw exists in versions 3.12.0 through 4.2.16 and 4.4.11.

Detection Guidance

Detecting this vulnerability requires checking the installed version of GeoNetwork. Compare your version against the fixed versions (4.2.16, 4.4.11). Use commands like 'curl -s http://your-geonetwork-url/geonetwork/srv/eng/info?type=mef' or check the version in the admin panel. If your version is between 3.12.0 and 4.2.16 or 4.4.11, the system is vulnerable.

Impact Analysis

An attacker could trick users into visiting a malicious site after login, potentially leading to phishing attacks, credential theft, or session hijacking. Users of affected GeoNetwork versions may be redirected to attacker-controlled domains without their knowledge.

Compliance Impact

This vulnerability could lead to unauthorized access to user data, violating GDPR's data protection principles and HIPAA's security requirements for protected health information. Organizations using affected versions may face compliance violations and potential fines.

Mitigation Strategies

Upgrade GeoNetwork to version 4.2.16 or 4.4.11 immediately. If upgrading is not possible, disable OAuth2 and Keycloak authentication filters temporarily. Review and restrict redirect URLs in the authentication filters to trusted domains only.

Hi! I’m here to help you understand CVE-2026-53573. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70