CVE-2026-53683

Description

reset_password.html parses query string parameters and uses the 'url' parameter as a redirection target (window.location = url) after password reset, optionally delayed by a 'delay' parameter. No validation or allowlisting is performed on url, enabling an attacker to redirect users to an arbitrary external site after completion of the password-reset workflow.

Traduire en français

Produits concernés

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Red Hat Enterprise Linux 7
• Red Hat Enterprise Linux 8
• Red Hat Enterprise Linux 9

Scores CVSS

Faiblesses (CWE)

• CWE-601

Références

• https://access.redhat.com/security/cve/CVE-2026-53683
• https://bugzilla.redhat.com/show_bug.cgi?id=2487512

Ailleurs

• NVD
• CVE.org
• CIRCL Vulnerability-Lookup
• CERT-FR
• GitHub Advisories