{
  "affected": [
    {
      "ranges": [
        {
          "database_specific": {
            "extracted_events": [
              {
                "introduced": "3.12.0"
              },
              {
                "last_affected": "3.12.12"
              },
              {
                "introduced": "4.0.0-alpha.1"
              },
              {
                "last_affected": "4.0.6"
              },
              {
                "introduced": "4.2.0"
              },
              {
                "fixed": "4.2.16"
              }
            ],
            "source": "AFFECTED_FIELD"
          },
          "events": [
            {
              "introduced": "72bf9606a19b80dff9cd56fbe3f718a932f21aa3"
            },
            {
              "last_affected": "a99f09e716dc8106466eb13214a4cea06618516e"
            },
            {
              "introduced": "a998abae4f1e993edbdb89bb7fed2abef4d9e825"
            },
            {
              "last_affected": "55bb616a29bc47900d913125831d9af940f7afca"
            },
            {
              "introduced": "bdc0a9c92ef52718f7582bfa87149d1b93e02c0b"
            },
            {
              "fixed": "ab7b34fa04f79c12483dbaa17f75b8cd819dc050"
            }
          ],
          "repo": "https://github.com/geonetwork/core-geonetwork",
          "type": "GIT"
        }
      ]
    }
  ],
  "aliases": [
    "GHSA-pjp7-q6wp-97qx"
  ],
  "database_specific": {
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
      "CWE-601"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53573.json",
    "unresolved_ranges": [
      {
        "extracted_events": [
          {
            "introduced": "4.4.0"
          },
          {
            "fixed": "4.4.11"
          }
        ],
        "source": "AFFECTED_FIELD"
      }
    ]
  },
  "details": "GeoNetwork is a catalog application to manage spatially referenced resources. From 3.12.0 until 4.2.16 and 4.4.11, unsafe redirect validation in GeonetworkOAuth2LoginAuthenticationFilter and KeycloakAuthenticationProcessingFilter permits an attacker-controlled external redirect after login. This issue is fixed in versions 4.2.16 and 4.4.11.",
  "id": "CVE-2026-53573",
  "modified": "2026-08-04T11:31:08.366548455Z",
  "published": "2026-07-31T22:16:25.110Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/geonetwork/core-geonetwork/releases/tag/4.2.16"
    },
    {
      "type": "WEB",
      "url": "https://github.com/geonetwork/core-geonetwork/releases/tag/4.4.11"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53573.json"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/geonetwork/core-geonetwork/security/advisories/GHSA-pjp7-q6wp-97qx"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53573"
    },
    {
      "type": "FIX",
      "url": "https://github.com/geonetwork/core-geonetwork/commit/0d74f673dfc926bde935819ed34636d789b2fecd"
    },
    {
      "type": "FIX",
      "url": "https://github.com/geonetwork/core-geonetwork/commit/cde9b6481a29e2473b7b74479b4e3fd6843bac4e"
    },
    {
      "type": "FIX",
      "url": "https://github.com/geonetwork/core-geonetwork/pull/9307"
    },
    {
      "type": "FIX",
      "url": "https://github.com/geonetwork/core-geonetwork/pull/9309"
    }
  ],
  "schema_version": "1.8.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "core-geonetwork has an Open Redirect Bypass"
}