CVE-2026-53573
core-geonetwork has an Open Redirect Bypass
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
GeoNetwork is a catalog application to manage spatially referenced resources. From 3.12.0 until 4.2.16 and 4.4.11, unsafe redirect validation in GeonetworkOAuth2LoginAuthenticationFilter and KeycloakAuthenticationProcessingFilter permits an attacker-controlled external redirect after login. This issue is fixed in versions 4.2.16 and 4.4.11.
| CWE | CWE-601 |
| Vendor | geonetwork |
| Product | core-geonetwork |
| Published | Jul 31, 2026 |
Stay Ahead of the Next One
Get instant alerts for geonetwork core-geonetwork
Be the first to know when new unknown vulnerabilities affecting geonetwork core-geonetwork are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
geonetwork / core-geonetwork
>= 3.12.0, <= 3.12.12 >= 4.0.0-alpha.1, <= 4.0.6 >= 4.2.0, < 4.2.16 >= 4.4.0, < 4.4.11
References
github.com: https://github.com/geonetwork/core-geonetwork/security/advisories/GHSA-pjp7-q6wp-97qx github.com: https://github.com/geonetwork/core-geonetwork/pull/9307 github.com: https://github.com/geonetwork/core-geonetwork/pull/9309 github.com: https://github.com/geonetwork/core-geonetwork/commit/0d74f673dfc926bde935819ed34636d789b2fecd github.com: https://github.com/geonetwork/core-geonetwork/commit/cde9b6481a29e2473b7b74479b4e3fd6843bac4e github.com: https://github.com/geonetwork/core-geonetwork/releases/tag/4.2.16 github.com: https://github.com/geonetwork/core-geonetwork/releases/tag/4.4.11