CVE-2026-53573

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-53573
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-53573.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-53573
Aliases
Published
2026-07-31T22:16:25.110Z
Modified
2026-08-02T03:47:49.770816552Z
Severity
  • 4.8 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N CVSS Calculator
Summary
core-geonetwork has an Open Redirect Bypass
Details

GeoNetwork is a catalog application to manage spatially referenced resources. From 3.12.0 until 4.2.16 and 4.4.11, unsafe redirect validation in GeonetworkOAuth2LoginAuthenticationFilter and KeycloakAuthenticationProcessingFilter permits an attacker-controlled external redirect after login. This issue is fixed in versions 4.2.16 and 4.4.11.

Database specific 
{
    "cwe_ids": [
        "CWE-601"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53573.json",
    "cna_assigner": "GitHub_M",
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "introduced": "4.4.0"
                },
                {
                    "fixed": "4.4.11"
                }
            ]
        }
    ]
}
References

Affected packages

Git / github.com/geonetwork/core-geonetwork

Affected ranges

Type
GIT
Repo
https://github.com/geonetwork/core-geonetwork
Events
Introduced
72bf9606a19b80dff9cd56fbe3f718a932f21aa3
Introduced
a998abae4f1e993edbdb89bb7fed2abef4d9e825
Introduced
bdc0a9c92ef52718f7582bfa87149d1b93e02c0b
Fixed
0d74f673dfc926bde935819ed34636d789b2fecd
Fixed
cde9b6481a29e2473b7b74479b4e3fd6843bac4e
Fixed
ab7b34fa04f79c12483dbaa17f75b8cd819dc050
Database specific 
{
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "3.12.0"
        },
        {
            "last_affected": "3.12.12"
        },
        {
            "introduced": "4.0.0-alpha.1"
        },
        {
            "last_affected": "4.0.6"
        },
        {
            "introduced": "4.2.0"
        },
        {
            "fixed": "4.2.16"
        }
    ]
}

Affected versions

4.*
4.2.0
4.2.1
4.2.10
4.2.11
4.2.13
4.2.14
4.2.15
4.2.2
4.2.3
4.2.4
4.2.5
4.2.6
4.2.7
4.2.8
4.2.9
4.4.0
4.4.1
4.4.10
4.4.2
4.4.3
4.4.4
4.4.5
4.4.6
4.4.7
4.4.8
4.4.9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-53573.json"