CVE-2026-93649
Awaiting Analysis Awaiting Analysis - Queue

Open Redirect Vulnerability in Eclipse Adoptium Website

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: Eclipse Foundation

Description
In the Eclipse Adoptium website (adoptium.net), in every deployment built from commit 0b24ea1 (2025-06-18) up to the fix in commit cbb53cf (2026-09-24), the post-download page /[locale]/download takes a download URL from the "link" query parameter and automatically navigates to it with a meta http-equiv="refresh". The URL is checked against a list of trusted prefixes using String.startsWith() on the raw string, while the browser applies RFC 3986 dot-segment normalisation before navigating, so a value such as https://github.com/adoptium/temurin/../../attacker/malware/releases/download/v1/jdk.exe passes the check but resolves to an attacker-controlled repository. A victim who follows a crafted adoptium.net link is shown the genuine "Thank you for downloading Eclipse Temurin" page while their browser downloads a binary of the attacker's choosing

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-15
Last Modified
2026-10-15
Generated
2026-10-15
AI Q&A
2026-10-15
EPSS Evaluated
N/A
NVD
CVE-2026-93649
EUVD
EUVD-2026-102088

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Eclipse Foundation Adoptium Temurin 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-601 The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.
CWE-494 The product downloads source code or an executable from a remote location and executes the code without sufficiently verifying the origin and integrity of the code.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves a path traversal flaw in the Eclipse Adoptium website (adoptium.net). When users download software, the site uses a 'link' query parameter to redirect them. The site checks if the URL starts with trusted prefixes but fails to properly normalize paths. Attackers can craft URLs with dot-segment traversals (e.g., ../) that bypass checks but resolve to malicious destinations. Victims see a legitimate download page while their browser downloads attacker-controlled files.

Detection Guidance

Check your web server or proxy logs for requests to adoptium.net/download with unusual query parameters containing path traversal sequences like ../ or encoded equivalents. Inspect browser downloads originating from adoptium.net links for unexpected file paths or sources.

Impact Analysis

If you click a crafted link on adoptium.net, you may unknowingly download malware instead of the intended Eclipse Temurin JDK. This could lead to system compromise, data theft, or further malware infections. The attack is stealthy because the download page appears legitimate.

Compliance Impact

This vulnerability could lead to unauthorized data access or malware distribution, which may violate GDPR's data protection requirements if personal data is exposed, and HIPAA's security rules if protected health information is compromised. The lack of proper URL validation undermines secure data handling practices required by these regulations.

Mitigation Strategies

Update your adoptium.net deployment to commit cbb53cf or later to apply the patched URL validation logic. Block or monitor any download requests from adoptium.net that do not use the corrected validation function.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-93649. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart