CVE-2026-53573
GeoNetwork is a catalog application to manage spatially referenced resources. From 3.12.0 until 4.2.16 and 4.4.11, unsafe redirect validation in GeonetworkOAuth2LoginAuthenticationFilter and KeycloakAuthenticationProcessingFilter permits an attacker-controlled external redirect after login. This issue is fixed in versions 4.2.16 and 4.4.11.
- CVSS 4.0
- 4.8
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N - EPSS
- 0.6% chance of exploitation in the next 30 days; higher than 50% of CVEs (scores of 2026-10-25)
- CWE
- CWE-601
- Published
- Modified
- Record from
- the NVD, synced
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-pjp7-q6wp-97qx | Maven | org.geonetwork-opensource:geonetwork | >=3.12.0 <=3.12.12 | no fix published |
| GHSA-pjp7-q6wp-97qx | Maven | org.geonetwork-opensource:geonetwork | >=4.0.0-alpha.1 <=4.0.6 | no fix published |
| GHSA-pjp7-q6wp-97qx | Maven | org.geonetwork-opensource:geonetwork | >=4.2.0 <4.2.16 | 4.2.16 |
| GHSA-pjp7-q6wp-97qx | Maven | org.geonetwork-opensource:geonetwork | >=4.4.0 <4.4.11 | 4.4.11 |
References
- https://github.com/geonetwork/core-geonetwork/commit/0d74f673dfc926bde935819ed34636d789b2fecd
- https://github.com/geonetwork/core-geonetwork/commit/cde9b6481a29e2473b7b74479b4e3fd6843bac4e
- https://github.com/geonetwork/core-geonetwork/pull/9307
- https://github.com/geonetwork/core-geonetwork/pull/9309
- https://github.com/geonetwork/core-geonetwork/releases/tag/4.2.16