CVE-2026-53683: URL Redirection to Untrusted Site ('Open Redirect') in Red Hat Red Hat Enterprise Linux 10

The vulnerability exists in reset_password.html of Red Hat Enterprise Linux 10, where the 'url' query parameter is used directly as a client-side redirection target (window.location = url) after password reset. There is no validation or allowlisting of the 'url' parameter, allowing attackers to craft links that redirect users to arbitrary external sites post-password reset. This open redirect (CWE-601) can facilitate phishing attacks by making malicious sites appear trustworthy. The CVSS v3.1 score is 4.3 (medium), reflecting low integrity impact and no confidentiality or availability impact. The vendor advisory emphasizes the risk is limited to phishing/social engineering and does not disclose or modify data.

The vulnerability allows attackers to redirect users to untrusted external websites after password reset, which can enable phishing attacks or social engineering. There is no direct data disclosure, modification, or system compromise from the vulnerability itself. The primary risk is that users may be tricked into interacting with malicious sites that appear legitimate due to the redirection from a trusted domain.

Red Hat recommends eliminating arbitrary URL redirects. If a post-reset return URL is necessary, it should be restricted to same-origin paths or validated against a strict allowlist of trusted hosts and HTTPS scheme. Prefer server-generated, signed return tokens instead of raw URLs, and ensure the UI uses safe navigation helpers that reject dangerous schemes and external origins. The vendor advisory does not explicitly state a patch is available; therefore, patch status is not yet confirmed—check the vendor advisory for current remediation guidance.