Bug 2532946

Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

Description
reset_password.html parses query string parameters and uses url as a redirection target (window.location = url) after password reset, optionally delayed by delay. No validation or allowlisting is performed on url, enabling an attacker to redirect users to an arbitrary external site after completion of the workflow. 
Impact
An attacker must entice a victim to use the crafted reset URL (not hard, as the URL domain appears legitimate). No attacker authentication is required. The redirect can be used for phishing and user-trust abuse (appearing to originate from IdM), and can assist chaining with other social engineering or browser attacks by moving users from a trusted IdM origin to an attacker-controlled site at a sensitive moment. Ultimately, the attacker can get a user to visit a malicious URL while appearing legitimate. 
Recommendations
Eliminate arbitrary URL redirects. If a post-reset return URL is required, allowlist same-origin paths only, or validate against a strict allowlist of trusted hosts and HTTPS scheme. Prefer server-generated, signed return tokens instead of raw URLs. Ensure the UI uses safe navigation helpers and rejects or strips dangerous schemes and external origins.