{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-53573", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-06-09T19:11:53.483Z", "datePublished": "2026-07-31T22:16:25.110Z", "dateUpdated": "2026-07-31T22:16:25.110Z"}, "containers": {"cna": {"title": "core-geonetwork has an Open Redirect Bypass", "problemTypes": [{"descriptions": [{"cweId": "CWE-601", "lang": "en", "description": "CWE-601: URL Redirection to Untrusted Site ('Open Redirect')", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "ACTIVE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "baseScore": 4.8, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/geonetwork/core-geonetwork/security/advisories/GHSA-pjp7-q6wp-97qx", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/geonetwork/core-geonetwork/security/advisories/GHSA-pjp7-q6wp-97qx"}, {"name": "https://github.com/geonetwork/core-geonetwork/pull/9307", "tags": ["x_refsource_MISC"], "url": "https://github.com/geonetwork/core-geonetwork/pull/9307"}, {"name": "https://github.com/geonetwork/core-geonetwork/pull/9309", "tags": ["x_refsource_MISC"], "url": "https://github.com/geonetwork/core-geonetwork/pull/9309"}, {"name": "https://github.com/geonetwork/core-geonetwork/commit/0d74f673dfc926bde935819ed34636d789b2fecd", "tags": ["x_refsource_MISC"], "url": "https://github.com/geonetwork/core-geonetwork/commit/0d74f673dfc926bde935819ed34636d789b2fecd"}, {"name": "https://github.com/geonetwork/core-geonetwork/commit/cde9b6481a29e2473b7b74479b4e3fd6843bac4e", "tags": ["x_refsource_MISC"], "url": "https://github.com/geonetwork/core-geonetwork/commit/cde9b6481a29e2473b7b74479b4e3fd6843bac4e"}, {"name": "https://github.com/geonetwork/core-geonetwork/releases/tag/4.2.16", "tags": ["x_refsource_MISC"], "url": "https://github.com/geonetwork/core-geonetwork/releases/tag/4.2.16"}, {"name": "https://github.com/geonetwork/core-geonetwork/releases/tag/4.4.11", "tags": ["x_refsource_MISC"], "url": "https://github.com/geonetwork/core-geonetwork/releases/tag/4.4.11"}], "affected": [{"vendor": "geonetwork", "product": "core-geonetwork", "versions": [{"version": ">= 3.12.0, <= 3.12.12", "status": "affected"}, {"version": ">= 4.0.0-alpha.1, <= 4.0.6", "status": "affected"}, {"version": ">= 4.2.0, < 4.2.16", "status": "affected"}, {"version": ">= 4.4.0, < 4.4.11", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-31T22:16:25.110Z"}, "descriptions": [{"lang": "en", "value": "GeoNetwork is a catalog application to manage spatially referenced resources. From 3.12.0 until 4.2.16 and 4.4.11, unsafe redirect validation in GeonetworkOAuth2LoginAuthenticationFilter and KeycloakAuthenticationProcessingFilter permits an attacker-controlled external redirect after login. This issue is fixed in versions 4.2.16 and 4.4.11."}], "source": {"advisory": "GHSA-pjp7-q6wp-97qx", "discovery": "UNKNOWN"}}}}

{}

{}

{}

{}