CVE-2026-53573: 
Java 脆弱性の分析と軽減

CVE-2026-53573 is an open redirect vulnerability (CWE-601) in GeoNetwork, an open-source catalog application for managing spatially referenced resources. The flaw exists in the post-login redirect handling of GeonetworkOAuth2LoginAuthenticationFilter and KeycloakAuthenticationProcessingFilter, where insufficient validation of the redirectUrl parameter allows an attacker-controlled external redirect after a successful login. Affected versions span from 3.12.0 through 3.12.12, 4.0.0-alpha.1 through 4.0.6, 4.2.0 through 4.2.15, and 4.4.0 through 4.4.10. The advisory was published on July 31, 2026, with patches available in versions 4.2.16 and 4.4.11. The CVSS v4.0 base score is 4.8 (Medium) (GitHub Advisory).

The root cause is insufficient URL validation (CWE-601) in both GeonetworkOAuth2LoginAuthenticationFilter and KeycloakAuthenticationProcessingFilter. Both filters attempted to restrict post-login redirects to relative, in-application URLs by checking whether the URI was non-absolute using Java's URI.isAbsolute(), but this check failed to reject protocol-relative URLs (e.g., //evil.example.com) and certain other bypass patterns that browsers resolve as external hosts. The fix introduced a centralized RedirectUtil helper class that enforces stricter validation: a safe redirect must start with a single / (not // or /\), must not carry a URI scheme, and must not declare any host or authority component; anything else falls back to the application context home (GitHub Advisory, Fix PR #9307).

Successful exploitation allows an attacker to craft a malicious link to a legitimate GeoNetwork OAuth2/OIDC or Keycloak login endpoint that, after the victim completes authentication, silently redirects them to an arbitrary external site. This can be leveraged for phishing attacks — for example, presenting a fake login page to harvest credentials — or to chain into other externally hosted attacks. The vulnerability does not bypass authentication, expose GeoNetwork data directly, or affect confidentiality or availability of the application itself (GitHub Advisory).

No public exploit code or in-the-wild exploitation has been reported for CVE-2026-53573. The EPSS score is approximately 0.377%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires user interaction — a victim must click a crafted link and complete the login flow — and the NVD SSVC assessment classifies exploitation as "none" with non-automatable attack characteristics (GitHub Advisory).

1. Identify target: Locate a GeoNetwork instance (versions 3.12.0–3.12.12, 4.0.0-alpha.1–4.0.6, 4.2.0–4.2.15, or 4.4.0–4.4.10) configured with OAuth2/OIDC or Keycloak SSO login.
2. Craft malicious URL: Construct a login URL that includes a redirectUrl parameter containing a protocol-relative or otherwise bypass-capable external URL, e.g., https://geonetwork.example.org/geonetwork/signin?redirectUrl=//evil.example.com/phish.
3. Deliver to victim: Send the crafted URL to a target user via phishing email, social media, or other social engineering channels, leveraging the legitimacy of the GeoNetwork domain.
4. Victim authenticates: The victim clicks the link, is presented with the legitimate GeoNetwork/IdP login page, and completes authentication normally.
5. Redirect executes: Upon successful login, the vulnerable filter processes the redirectUrl parameter, passes the bypass validation check, and issues a redirect response sending the victim's browser to the attacker-controlled external site.
6. Phishing or chaining: The attacker's site presents a fake login form or other malicious content to harvest credentials or deliver further payloads (GitHub Advisory, Fix PR #9307).

• Network: HTTP requests to GeoNetwork OAuth2/OIDC or Keycloak login endpoints containing a redirectUrl query parameter with values starting with //, http://, or https:// pointing to external domains; outbound HTTP redirects (3xx responses) from the GeoNetwork server to non-local hosts following login flows.
• Logs: GeoNetwork application logs (security log channel) showing entries such as "Failed to perform login redirect to '//evil.example.com'" or "Refused unsafe login redirect to '...'" (the latter only present after patching); web/access logs showing POST/GET requests to /geonetwork/signin or equivalent OAuth2 callback endpoints with suspicious redirectUrl parameter values.
• User Reports: End users reporting unexpected redirects to unfamiliar sites immediately after logging into GeoNetwork.

Upgrade GeoNetwork to version 4.2.16 or 4.4.11, which introduce a centralized RedirectUtil helper that strictly validates post-login redirect targets to server-local relative paths only, rejecting protocol-relative URLs and any external hosts (GitHub Advisory, Fix PR #9307). GeoNetwork 3.x and 4.0.x branches are archived and will not receive patches; operators running those versions should migrate to a supported release (4.2.16+ or 4.4.11+). No configuration-based workaround is documented; upgrading is the only recommended remediation.