CVE-2026-53573: GeoNetwork Auth Bypass Vulnerability

CVE-2026-53573 Overview

GeoNetwork is an open-source catalog application used to manage spatially referenced resources. CVE-2026-53573 is an open redirect vulnerability [CWE-601] affecting GeoNetwork versions from 3.12.0 up to 4.2.16 and 4.4.11. The flaw resides in GeonetworkOAuth2LoginAuthenticationFilter and KeycloakAuthenticationProcessingFilter, where unsafe redirect validation permits an attacker-controlled external redirect after login. An attacker can craft a login URL that redirects authenticated users to an arbitrary external site, enabling phishing and credential harvesting workflows. The issue is fixed in versions 4.2.16 and 4.4.11.

Critical Impact
Authenticated users can be silently redirected to attacker-controlled domains after login, enabling phishing campaigns that abuse the trust of the legitimate GeoNetwork login flow.

Affected Products

GeoNetwork versions 3.12.0 through 4.2.15
GeoNetwork 4.4.x versions prior to 4.4.11
Deployments using OAuth2 or Keycloak authentication filters

Discovery Timeline

2026-07-31 - CVE-2026-53573 published to NVD
2026-08-03 - Last updated in NVD database

Technical Details for CVE-2026-53573

Vulnerability Analysis

The vulnerability is a URL redirection to untrusted site issue, commonly known as an open redirect [CWE-601]. GeoNetwork's authentication filters accept a post-login redirect target without validating that the target URL points to an internal, trusted host. When a user completes authentication through OAuth2 or Keycloak, the filter forwards the browser to the supplied redirect parameter, which may reference an external attacker-controlled domain.

Open redirects on authentication endpoints are frequently chained with phishing. An attacker sends a victim a link that starts on the legitimate GeoNetwork host, the victim completes login, and the browser is then redirected to a look-alike site that harvests further credentials or delivers malicious payloads.

Root Cause

The root cause is missing or insufficient allowlist validation of redirect URLs in GeonetworkOAuth2LoginAuthenticationFilter and KeycloakAuthenticationProcessingFilter. The upstream fix introduces a centralized RedirectUtil helper and refactors success handlers such as GeonetworkSavedRequestAwareAuthenticationSuccessHandler and JeevesNodeAwareLogoutSuccessHandler to route redirect decisions through the hardened validator.

Attack Vector

Exploitation requires low-privileged access and user interaction. An attacker crafts a URL to the GeoNetwork login endpoint containing a redirect parameter pointing to an external domain. Once the victim authenticates, GeoNetwork returns an HTTP redirect to the attacker's URL.

java

// Patch excerpt: JeevesNodeAwareLogoutSuccessHandler.java
 package jeeves.config.springutil;

 import org.fao.geonet.NodeInfo;
+import org.fao.geonet.kernel.security.RedirectUtil;
 import org.fao.geonet.kernel.setting.SettingManager;
 import org.fao.geonet.kernel.setting.Settings;
 import org.fao.geonet.constants.Geonet;
+import org.fao.geonet.utils.Log;
-import org.fao.geonet.kernel.setting.SettingInfo;

-import java.net.MalformedURLException;
-import java.net.URL;
// Source: https://github.com/geonetwork/core-geonetwork/commit/cde9b6481a29e2473b7b74479b4e3fd6843bac4e

The patch removes ad-hoc URL parsing and delegates validation to the new RedirectUtil component, which enforces that redirects resolve to trusted internal targets.

Detection Methods for CVE-2026-53573

Indicators of Compromise

HTTP 302 responses from GeoNetwork login or logout endpoints with Location headers pointing to external, non-allowlisted domains.
Unusual redirect, redirect_uri, or saved-request parameters in access logs that reference third-party hosts.
Referer chains where users transition from a GeoNetwork domain to unrelated external sites immediately after /signin or Keycloak callback URLs.

Detection Strategies

Inspect web server and reverse proxy logs for login-flow requests containing fully qualified external URLs in redirect parameters.
Correlate authentication success events with subsequent outbound redirects to domains outside the organization's allowlist.
Hunt for phishing lures that embed the legitimate GeoNetwork hostname followed by suspicious redirect query strings.

Monitoring Recommendations

Enable verbose logging on GeonetworkOAuth2LoginAuthenticationFilter and KeycloakAuthenticationProcessingFilter to capture the requested target URL for each authentication event.
Alert on DNS or proxy telemetry showing user agents transitioning from GeoNetwork FQDNs to newly registered or low-reputation domains.
Baseline expected post-login destinations and flag deviations for review.

How to Mitigate CVE-2026-53573

Immediate Actions Required

Upgrade GeoNetwork to version 4.2.16 or 4.4.11 as appropriate for your branch.
Inventory all GeoNetwork deployments and confirm they are not running versions between 3.12.0 and the fixed releases.
Warn administrators and end users about phishing attempts that use crafted GeoNetwork login links.

Patch Information

The fix is delivered in pull requests #9307 and #9309, consolidated in commits cde9b64 and 0d74f67. Releases 4.2.16 and 4.4.11 contain the hardened redirect validation. Full advisory details are available in GHSA-pjp7-q6wp-97qx.

Workarounds

Deploy a reverse proxy or WAF rule that strips or rejects redirect parameters referencing external hosts on GeoNetwork login and logout endpoints.
Restrict outbound redirects at the proxy layer by allowlisting only known internal FQDNs in Location response headers from the authentication paths.
Educate users to avoid clicking GeoNetwork login links received from untrusted sources until patches are applied.

bash

# Example nginx rule to block external redirect parameters on login endpoints
location ~ ^/(signin|geonetwork/srv/.*/login|.*/keycloak) {
    if ($arg_redirect ~* "^https?://(?!geonetwork\.example\.com)") {
        return 400;
    }
    proxy_pass http://geonetwork_backend;
}