CVE-2026-53573 core-geonetwork has an Open Redirect Bypass
An attacker can bypass redirect validation to force users to external sites after login, potentially facilitating phishing attacks.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-53573?
CVE-2026-53573 is a medium-severity vulnerability in core-geonetwork, published on 31 Jul 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
GeoNetwork is a catalog application to manage spatially referenced resources. From 3.12.0 until 4.2.16 and 4.4.11, unsafe redirect validation in GeonetworkOAuth2LoginAuthenticationFilter and KeycloakAuthenticationProcessingFilter permits an attacker-controlled external redirect after login. This issue is fixed in versions 4.2.16 and 4.4.11.
Weakness: CWE-601
Which versions are affected by CVE-2026-53573?
8 open source packages ship an affected version, including org.geonetwork-opensource:geonetwork.
| Package | Affected | Fixed in |
|---|---|---|
org.geonetwork-opensource:geonetwork Maven | From 3.12.0 to 3.12.12 | None |
org.geonetwork-opensource:geonetwork Maven | From 3.12.0 to 3.12.12 | None |
org.geonetwork-opensource:geonetwork Maven | From 4.0.0-alpha.1 to 4.0.6 | None |
org.geonetwork-opensource:geonetwork Maven | From 4.0.0-alpha.1 to 4.0.6 | None |
org.geonetwork-opensource:geonetwork Maven | From 4.2.0 | 4.2.16 |
org.geonetwork-opensource:geonetwork Maven | From 4.2.0 | 4.2.16 |
2 more packages
org.geonetwork-opensource:geonetwork Maven | From 4.4.0 | 4.4.11 |
org.geonetwork-opensource:geonetwork Maven | From 4.4.0 | 4.4.11 |
How do I fix CVE-2026-53573?
Upgrade org.geonetwork-opensource:geonetwork to a fixed version for your release line: 4.2.16 or 4.4.11.
Is CVE-2026-53573 being exploited?
There is no known exploitation of CVE-2026-53573 in the wild and no public exploit code.
Sources
Also known as GHSA-pjp7-q6wp-97qx.