Description
reset_password.html parses query string parameters and uses the 'url' parameter as a redirection target (window.location = url) after password reset, optionally delayed by a 'delay' parameter. No validation or allowlisting is performed on url, enabling an attacker to redirect users to an arbitrary external site after completion of the password-reset workflow.
Published: 2026-09-02
Score: 4.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Open Redirect
Action: Implement Workaround
AI Analysis

Impact

The reset_password.html page in the idm/freeipa web UI parses query parameters and uses the raw 'url' value as a navigation target after a password reset. No validation or allowlisting is performed, enabling an attacker to supply an arbitrary external address that the browser will load as a redirect. This can lead users to phishing sites or other malicious destinations once the reset workflow completes.

Affected Systems

All versions of Red Hat Enterprise Linux from 6 through 10 contain the idm/freeipa web UI component that includes the vulnerable reset_password.html page. The vulnerability is present across the entire RHEL 6‑10 product family.

Risk and Exploitability

The recorded CVSS score of 4.3 reflects moderate severity. EPSS data is not available, and the issue is not listed in the CISA KEV catalog. Exploitation requires an attacker to craft a link that delivers the victim to the reset_password.html page with a malicious 'url' parameter. Once the victim follows the link after resetting their password, the browser will navigate to the supplied external site.

Generated by OpenCVE AI on September 2, 2026 at 11:20 UTC.

Remediation

Vendor Workaround

Eliminate arbitrary URL redirects. If a post-reset return URL is required, allowlist same-origin paths only, or validate against a strict allowlist of trusted hosts and the HTTPS scheme. Prefer server-generated, signed return tokens instead of raw URLs, and ensure the UI uses safe navigation helpers that reject dangerous schemes and external origins.

OpenCVE Recommended Actions

  • Restrict the redirect target to same‑origin paths or a strict allowlist of trusted hosts and the HTTPS scheme, as recommended in the CNA workaround.
  • Modify the client‑side code to validate the 'url' parameter against a whitelist and reject non‑HTTPS or external schemes, preferably replacing raw URLs with signed, server‑generated tokens.
  • Ensure the UI uses safe navigation helpers that reject dangerous schemes and external origins, following the CNA workaround guidance.

Generated by OpenCVE AI on September 2, 2026 at 11:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 02 Sep 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 02 Sep 2026 12:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Moderate

Wed, 02 Sep 2026 11:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-601

Wed, 02 Sep 2026 09:00:00 +0000

Type Values Removed Values Added
Description reset_password.html parses query string parameters and uses the 'url' parameter as a redirection target (window.location = url) after password reset, optionally delayed by a 'delay' parameter. No validation or allowlisting is performed on url, enabling an attacker to redirect users to an arbitrary external site after completion of the password-reset workflow.
Title Freeipa: idm: idm/freeipa web ui - client-side open redirect in reset_password.html
First Time appeared Redhat
Redhat enterprise Linux
CPEs cpe:/o:redhat:enterprise_linux:10
cpe:/o:redhat:enterprise_linux:6
cpe:/o:redhat:enterprise_linux:7
cpe:/o:redhat:enterprise_linux:8
cpe:/o:redhat:enterprise_linux:9
Vendors & Products Redhat
Redhat enterprise Linux
References
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N'}

Subscriptions

Redhat Enterprise Linux
cve-icon MITRE

Status: PUBLISHED

Assigner: redhat

Published:

Updated: 2026-09-14T07:53:31.159Z

Reserved: 2026-06-10T12:31:11.556Z

Link: CVE-2026-53683

cve-icon Vulnrichment

Updated: 2026-09-02T13:42:28.827Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-09-02T09:16:38.247

Modified: 2026-09-14T08:16:35.127

Link: CVE-2026-53683

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-08-30T12:00:00Z

Links: CVE-2026-53683 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-09-02T22:10:11Z

Weaknesses
  • CWE-601

    URL Redirection to Untrusted Site ('Open Redirect')