Listen to this Post
How CVE-2026-53573 Works
GeoNetwork is a catalog application for managing spatially referenced resources. A post-login open redirect vulnerability exists in versions from 3.12.0 up to but not including 4.2.16 and 4.4.11. The flaw resides in unsafe redirect validation within two authentication filters: `GeonetworkOAuth2LoginAuthenticationFilter` and KeycloakAuthenticationProcessingFilter.
Both the OAuth2/OIDC and Keycloak login filters attempt to validate the client-supplied post-login redirect target before forwarding the browser. However, this validation does not correctly reject every kind of URL that causes the browser to leave the GeoNetwork origin. Specifically, the filters fail to prevent protocol-relative redirects, allowing attackers to bypass validation using double-slash (//) syntax.
A value that is treated as a safe, in-application relative path by the filter can still cause the browser to be redirected to an external, attacker-controlled host. An attacker can craft a link to a legitimate GeoNetwork OAuth2/OIDC or Keycloak login endpoint that, after the login flow completes, redirects the victim to an arbitrary external site. This can be used for phishing—for example, presenting a fake login form—or to chain into other attacks hosted externally. The impact is classified as an Open Redirect (CWE-601).
The CVSS v4.0 base score is 4.8 (MEDIUM) with the vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N. GeoNetwork 3.x and 4.0.x are archived/unmaintained and will not receive a fix.
DailyCVE Form:
Platform: GeoNetwork core-geonetwork
Version: 3.12.0–4.2.16, 4.4.11
Vulnerability: Open Redirect Bypass
Severity: Medium (CVSS 4.8)
date: 2026-07-31
Prediction: 2026-08-01 (patch available)
What Undercode Say
Analytics:
The vulnerability stems from insufficient validation logic in `GeonetworkOAuth2LoginAuthenticationFilter` and KeycloakAuthenticationProcessingFilter. The fix introduces a centralized `RedirectUtil` class to safely validate login and logout redirects.
Check current GeoNetwork version Look for version in web.xml or build.properties cat /path/to/geonetwork/WEB-INF/web.xml | grep version
Verify if vulnerable filters are present grep -r "GeonetworkOAuth2LoginAuthenticationFilter" /path/to/geonetwork/ grep -r "KeycloakAuthenticationProcessingFilter" /path/to/geonetwork/
Fix commits:
Exploit
An attacker crafts a protocol-relative URL to bypass local redirection checks:
https://legitimate-geonetwork.com/signin/oauth2?redirect=//attacker.com/phishing
After the user authenticates via OAuth2/OIDC or Keycloak, the browser is redirected to //attacker.com/phishing—which resolves to `http://attacker.com/phishing` or `https://attacker.com/phishing` depending on the page’s protocol. The double-slash syntax is incorrectly treated as a relative path by the filter but interpreted as an external redirect by the browser.
Protection
- Upgrade GeoNetwork to version 4.2.16 or later, or 4.4.11 or later.
- Deploy WAF rules to drop requests with protocol-relative URL parameters (
//in redirect parameters). - Enforce strict Content Security Policy (CSP) to restrict navigation and form targets.
- Verify that custom authentication filters rely on `RedirectUtil` for redirection validation.
- Inspect configuration XML files to ensure `GeonetworkSavedRequestAwareAuthenticationSuccessHandler` is configured.
Impact
- Open Redirect (CWE-601) – allows attackers to redirect authenticated users to malicious external domains.
- Phishing – victims can be presented with fake login forms to harvest credentials.
- Chaining – can be combined with other externally hosted attacks.
- No direct data exposure – does not bypass authentication or expose GeoNetwork data directly.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
