GeoNetwork EUVD-2026-51668

Exploitation requires the target GeoNetwork instance to be configured with OAuth2/OIDC (via GeonetworkOAuth2LoginAuthenticationFilter) or Keycloak SSO (via KeycloakAuthenticationProcessingFilter) - instances using only local or form-based authentication are not affected by this flaw. The CVSS vector PR:L indicates that a low-privilege account context is part of the authentication chain (the victim must complete a valid login), and UI:A confirms the victim must actively follow the attacker-crafted link and authenticate. Exploitation does not bypass GeoNetwork authentication, does not expose internal data, and does not affect availability. Key limiting factors: the victim must click a crafted link, complete the SSO flow, and be susceptible to the resulting phishing page; automated mass exploitation is not feasible given the required active user interaction.

The CVSS 4.0 score of 4.8 (Medium) with vector AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N accurately reflects the constrained impact: no GeoNetwork data is disclosed, no GeoNetwork integrity is modified, and availability is unaffected. The PR:L metric indicates a low-privilege account context is involved in the authentication chain, and UI:A confirms that a victim must actively follow the crafted link and complete a login - reducing automation potential. The subsequent-system integrity impact (SI:L) captures the phishing risk to a victim's other credentials or sessions. No EPSS data was supplied and no CISA KEV listing exists, so broad automated exploitation is not indicated; this is a social-engineering enabler rather than a direct system compromise primitive. Instances running archived 3.x or 4.0.x branches face elevated long-term risk because no fix will be issued for those lines. Real-world priority is moderate for internet-facing GeoNetwork portals using SSO and lower for internal-only deployments where attacker-crafted link delivery is harder.

An attacker identifies a public GeoNetwork instance configured with OAuth2/OIDC or Keycloak SSO and crafts a login URL embedding a protocol-relative redirect parameter (e.g., ?redirectUrl=//attacker.example.com/fake-geonetwork). The attacker sends this link via phishing email to GeoNetwork users; the victim clicks the link, is taken through the legitimate GeoNetwork SSO login flow, and upon successful authentication is silently forwarded by the flawed redirect validation to the attacker's credential-harvesting page. No public POC exists at time of analysis, but the technique is a well-understood variant of CWE-601 requiring only a standard HTTP request to craft.