Executive brief
GeoNetwork, an application used to manage geographic data and maps, contains a security flaw in its login process. An attacker can trick users into visiting a malicious website by redirecting them to an external link immediately after they log in. This can be used in phishing campaigns to steal user credentials or distribute malware by making the malicious site appear to be part of the trusted GeoNetwork portal.
Technical details
An open redirect vulnerability (CWE-601) exists in GeoNetwork's GeonetworkOAuth2LoginAuthenticationFilter and KeycloakAuthenticationProcessingFilter. The application fails to properly validate the 'redirectUrl' parameter during the authentication flow, allowing it to point to external domains. An attacker can craft a link that, upon successful authentication by a user, redirects the victim to an attacker-controlled site. The fix involves centralizing validation in a RedirectUtil helper that restricts redirects to server-local relative paths. Patches are available in versions 4.2.16 and 4.4.11.
Affected products
- GeoNetwork GeoNetwork 3.12.0 to 4.2.15, 4.4.0 to 4.4.10
Timeline
- 2026-06-01: patched: Fixes merged into main and 4.2.x branches
- 2026-07-31: disclosed: CVE-2026-53573 published
References
- https://github.com/geonetwork/core-geonetwork/commit/0d74f673dfc926bde935819ed34636d789b2fecd
- https://github.com/geonetwork/core-geonetwork/commit/cde9b6481a29e2473b7b74479b4e3fd6843bac4e
- https://github.com/geonetwork/core-geonetwork/pull/9307
- https://github.com/geonetwork/core-geonetwork/pull/9309
- https://github.com/geonetwork/core-geonetwork/releases/tag/4.2.16
- https://github.com/geonetwork/core-geonetwork/releases/tag/4.4.11
- https://github.com/geonetwork/core-geonetwork/security/advisories/GHSA-pjp7-q6wp-97qx