GeoNetwork, a spatial resource catalog, has a flaw in its OAuth2 and Keycloak authentication filters that allows attackers to manipulate the post‑login redirect URL so that users are sent to a malicious external site. This open redirect can be exploited after an attacker has gained access to the login process, enabling phishing or social engineering attacks. The weakness is a classic unsafe redirect validation (CWE‑601).

The vulnerability affects the GeoNetwork core-geonetwork application in versions 3.12.0 through 4.2.16 and 4.4.11. These releases allow an attacker‑controlled redirect after successful authentication via OAuth2 or Keycloak.

The CVSS score of 4.8 indicates moderate severity, and an EPSS score of less than 1 % suggests low likelihood of exploitation in the wild. The issue is not listed in the CISA KEV catalog. Attackers would need to target the login flow and supply a crafted redirect parameter; no privilege escalation or remote code execution is required. The risk is primarily the potential for users to be sent to malicious sites after authentication.