CVE-2026-53683: Freeipa: idm: idm/freeipa web ui - client-side open redirect in reset_password.html
Description resetpassword.html parses query string parameters and uses url as a redirection target (window.location = url) after password reset, optionally delayed by delay. No validation or allowlisting is performed on url, enabling an attacker to redirect users to an arbitrary external site after completion of the workflow. Impact An attacker must entice a victim to use the crafted reset URL (not hard, as the URL domain appears legitimate). No attacker authentication is required. The redirect can be used for phishing and user-trust abuse (appearing to originate from IdM), and can assist chaining with other social engineering or browser attacks by moving users from a trusted IdM origin to an attacker-controlled site at a sensitive moment. Ultimately, the attacker can get a user to visit a malicious URL while appearing legitimate. Recommendations Eliminate arbitrary URL redirects. If a post-reset return URL is required, allowlist same-origin paths only, or validate against a strict allowlist of trusted hosts and HTTPS scheme. Prefer server-generated, signed return tokens instead of raw URLs. Ensure the UI uses safe navigation helpers and rejects or strips dangerous schemes and external origins.
Other sources
resetpassword.html parses query string parameters and uses the 'url' parameter as a redirection target (window.location = url) after password reset, optionally delayed by a 'delay' parameter. No validation or allowlisting is performed on url, enabling an attacker to redirect users to an arbitrary external site after completion of the password-reset workflow.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
In reset_password.html, do not use the query-string parameter 'url' directly for redirection (window.location = url). Instead, validate it: allow only same-origin paths (or match an explicit allowlist of trusted hosts) and require the HTTPS scheme; reject or strip dangerous schemes (e.g., non-HTTPS, javascript/data) and external origins before performing the redirect.
freeipa: idm/freeipa web ui (reset_password.html) window.location redirection target from query parameter 'url' = Reject or strip dangerous schemes and external origins; only allow same-origin paths (or strict allowlist of trusted hosts) with HTTPS - Configuration
Modify the password-reset workflow to use server-generated, signed return tokens rather than accepting raw return URLs via an untrusted query parameter.
freeipa: idm/freeipa web ui (reset_password.html) post-reset return URL handling = Prefer server-generated, signed return tokens over raw URLs