{"id":"CVE-2026-53683","title":"Freeipa: idm: idm/freeipa web ui - client-side open redirect in reset_password.html","summary":"reset_password.html parses query string parameters and uses the 'url' parameter as a redirection target (window.location = url) after password reset, optionally delayed by a 'delay' parameter. No validation or allowlisting is performed o…","severity":"medium","cvss":4.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","cvssSource":"cna","cwe":["CWE-601"],"vendor":"Red Hat","product":"ipa","affected":["ipa (all versions)","ipa","ipa (all versions)","idm:client/ipa (all versions)","idm:DL1/ipa (all versions)","ipa (all versions)","ipa (all versions)"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-09-02T13:42:27.868419Z"},"published":"2026-09-02","updated":"2026-09-14","sourceUpdated":"2026-09-14T07:53:31.159Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-53683","references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-53683"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2487512","label":"RHBZ#2487512"}],"tags":["cve.org"],"epss":0.00162,"epssPercentile":0.05804,"ingestedAt":"2026-09-14T15:23:07.464Z","slug":"CVE-2026-53683","body":"## Overview\n\nreset_password.html parses query string parameters and uses the 'url' parameter as a redirection target (window.location = url) after password reset, optionally delayed by a 'delay' parameter. No validation or allowlisting is performed on url, enabling an attacker to redirect users to an arbitrary external site after completion of the password-reset workflow.\n\n## Affected\n\n- `ipa (all versions)`\n- `ipa`\n- `ipa (all versions)`\n- `idm:client/ipa (all versions)`\n- `idm:DL1/ipa (all versions)`\n- `ipa (all versions)`\n- `ipa (all versions)`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n### Workarounds\n\nEliminate arbitrary URL redirects. If a post-reset return URL is required, allowlist same-origin paths only, or validate against a strict allowlist of trusted hosts and the HTTPS scheme. Prefer server-generated, signed return tokens instead of raw URLs, and ensure the UI uses safe navigation helpers that reject dangerous schemes and external origins.","depth":"sunlit","depthScore":24,"depthScoreParts":{"impact":23.7,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}