CVE-2026-53683: Freeipa: idm: idm/freeipa web ui - client-side open redirect in reset_password.html

Published Jun 10, 2026
·
Updated

Description resetpassword.html parses query string parameters and uses url as a redirection target (window.location = url) after password reset, optionally delayed by delay. No validation or allowlisting is performed on url, enabling an attacker to redirect users to an arbitrary external site after completion of the workflow. Impact An attacker must entice a victim to use the crafted reset URL (not hard, as the URL domain appears legitimate). No attacker authentication is required. The redirect can be used for phishing and user-trust abuse (appearing to originate from IdM), and can assist chaining with other social engineering or browser attacks by moving users from a trusted IdM origin to an attacker-controlled site at a sensitive moment. Ultimately, the attacker can get a user to visit a malicious URL while appearing legitimate. Recommendations Eliminate arbitrary URL redirects. If a post-reset return URL is required, allowlist same-origin paths only, or validate against a strict allowlist of trusted hosts and HTTPS scheme. Prefer server-generated, signed return tokens instead of raw URLs. Ensure the UI uses safe navigation helpers and rejects or strips dangerous schemes and external origins.

Other sources

resetpassword.html parses query string parameters and uses the 'url' parameter as a redirection target (window.location = url) after password reset, optionally delayed by a 'delay' parameter. No validation or allowlisting is performed on url, enabling an attacker to redirect users to an arbitrary external site after completion of the password-reset workflow.

MITRE

Affected Software

1 affected component
FreeIPA FreeIPA web UI

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Configuration

    In reset_password.html, do not use the query-string parameter 'url' directly for redirection (window.location = url). Instead, validate it: allow only same-origin paths (or match an explicit allowlist of trusted hosts) and require the HTTPS scheme; reject or strip dangerous schemes (e.g., non-HTTPS, javascript/data) and external origins before performing the redirect.

    freeipa: idm/freeipa web ui (reset_password.html) window.location redirection target from query parameter 'url' = Reject or strip dangerous schemes and external origins; only allow same-origin paths (or strict allowlist of trusted hosts) with HTTPS
  2. Configuration

    Modify the password-reset workflow to use server-generated, signed return tokens rather than accepting raw return URLs via an untrusted query parameter.

    freeipa: idm/freeipa web ui (reset_password.html) post-reset return URL handling = Prefer server-generated, signed return tokens over raw URLs

Event History

Jun 10, 2026
Data Sourced
via Red Hat·12:48 PM
DescriptionSeverityAffected Software
Sep 2, 2026
CVE Published
via MITRE·08:54 AM
Data Sourced
via MITRE·08:54 AM
DescriptionSeverity
Data Sourced
via NVD·09:16 AM
DescriptionSeverityWeakness

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203