{"id":"CVE-2026-93649","aliases":["EUVD-2026-102088","GHSA-5w25-6xp6-x3fm","GHSA-f228-m952-5r6w"],"status":"published","title":"In the Eclipse Adoptium website (adoptium.net), in every deployment built from commit 0b24ea1 ...","description":"In the Eclipse Adoptium website (adoptium.net), in every deployment built from commit 0b24ea1 (2025-06-18) up to the fix in commit cbb53cf (2026-09-24), the post-download page /[locale]/download takes a download URL from the \"link\" query parameter and automatically navigates to it with a meta http-equiv=\"refresh\". The URL is checked against a list of trusted prefixes using String.startsWith() on the raw string, while the browser applies RFC 3986 dot-segment normalisation before navigating, so a value such as https://github.com/adoptium/temurin/../../attacker/malware/releases/download/v1/jdk.exe passes the check but resolves to an attacker-controlled repository. A victim who follows a crafted adoptium.net link is shown the genuine \"Thank you for downloading Eclipse Temurin\" page while their browser downloads a binary of the attacker's choosing","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.00156,"percentile":0.04762,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-494","CWE-601"],"published":"2026-10-15T13:28:42Z","modified":"2026-10-28T02:30:27Z","products":[{"vendor":"eclipse foundation","product":"adoptium temurin"}],"references":[{"url":"https://github.com/adoptium/adoptium.net/security/advisories/GHSA-f228-m952-5r6w#event-1046947","tags":["advisory"]},{"url":"https://gitlab.eclipse.org/security/cve-assignment/-/work_items/313","tags":["web"]},{"url":"https://github.com/adoptium/adoptium.net/commit/cbb53cf4a41f068a70902217473d7e2fe5d6c6ad","tags":["fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93649","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-5w25-6xp6-x3fm"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/93xxx/CVE-2026-93649.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-93649","description":"In the Eclipse Adoptium website (adoptium.net), in every deployment built from commit 0b24ea1 (2025-06-18) up to the fix in commit cbb53cf (2026-09-24), the post-download page /[locale]/download takes a download URL from the \"link\" query parameter and automatically navigates to it with a meta http-equiv=\"refresh\". The URL is checked against a list of trusted prefixes using String.startsWith() on the raw string, while the browser applies RFC 3986 dot-segment normalisation before navigating, so a value such as https://github.com/adoptium/temurin/../../attacker/malware/releases/download/v1/jdk.exe passes the check but resolves to an attacker-controlled repository. A victim who follows a crafted adoptium.net link is shown the genuine \"Thank you for downloading Eclipse Temurin\" page while their browser downloads a binary of the attacker's choosing","status":"published","published":"2026-10-15T13:28:42.59Z","modified":"2026-10-16T18:46:25.952Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"adp"}],"cwes":["CWE-494","CWE-601"],"updated_at":"2026-11-02T14:19:54.122945Z"}],"euvd":[{"id":"EUVD-2026-102088","description":"In the Eclipse Adoptium website (adoptium.net), in every deployment built from commit 0b24ea1 (2025-06-18) up to the fix in commit cbb53cf (2026-09-24), the post-download page /[locale]/download takes a download URL from the \"link\" query parameter and automatically navigates to it with a meta http-equiv=\"refresh\". The URL is checked against a list of trusted prefixes using String.startsWith() on the raw string, while the browser applies RFC 3986 dot-segment normalisation before navigating, so a value such as https://github.com/adoptium/temurin/../../attacker/malware/releases/download/v1/jdk.exe passes the check but resolves to an attacker-controlled repository. A victim who follows a crafted adoptium.net link is shown the genuine \"Thank you for downloading Eclipse Temurin\" page while their browser downloads a binary of the attacker's choosing","status":"published","published":"2026-10-15T13:28:42Z","modified":"2026-10-16T18:46:25Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T17:00:03.938875Z"}],"ghsa":[{"id":"GHSA-5w25-6xp6-x3fm","title":"In the Eclipse Adoptium website (adoptium.net), in every deployment built from commit 0b24ea1 ...","description":"In the Eclipse Adoptium website (adoptium.net), in every deployment built from commit 0b24ea1 (2025-06-18) up to the fix in commit cbb53cf (2026-09-24), the post-download page /[locale]/download takes a download URL from the \"link\" query parameter and automatically navigates to it with a meta http-equiv=\"refresh\". The URL is checked against a list of trusted prefixes using String.startsWith() on the raw string, while the browser applies RFC 3986 dot-segment normalisation before navigating, so a value such as https://github.com/adoptium/temurin/../../attacker/malware/releases/download/v1/jdk.exe passes the check but resolves to an attacker-controlled repository. A victim who follows a crafted adoptium.net link is shown the genuine \"Thank you for downloading Eclipse Temurin\" page while their browser downloads a binary of the attacker's choosing","status":"published","published":"2026-10-15T18:32:34Z","modified":"2026-10-16T21:32:43Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-494"],"updated_at":"2026-11-02T15:13:52.91817Z"}],"nvd":[{"id":"CVE-2026-93649","description":"In the Eclipse Adoptium website (adoptium.net), in every deployment built from commit 0b24ea1 (2025-06-18) up to the fix in commit cbb53cf (2026-09-24), the post-download page /[locale]/download takes a download URL from the \"link\" query parameter and automatically navigates to it with a meta http-equiv=\"refresh\". The URL is checked against a list of trusted prefixes using String.startsWith() on the raw string, while the browser applies RFC 3986 dot-segment normalisation before navigating, so a value such as https://github.com/adoptium/temurin/../../attacker/malware/releases/download/v1/jdk.exe passes the check but resolves to an attacker-controlled repository. A victim who follows a crafted adoptium.net link is shown the genuine \"Thank you for downloading Eclipse Temurin\" page while their browser downloads a binary of the attacker's choosing","status":"published","published":"2026-10-15T14:17:30.107Z","modified":"2026-10-16T19:17:44.9Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-494","CWE-601"],"updated_at":"2026-11-02T14:12:59.328869Z"}],"osv":[{"id":"CVE-2026-93649","description":"In the Eclipse Adoptium website (adoptium.net), in every deployment built from commit 0b24ea1 (2025-06-18) up to the fix in commit cbb53cf (2026-09-24), the post-download page /[locale]/download takes a download URL from the \"link\" query parameter and automatically navigates to it with a meta http-equiv=\"refresh\". The URL is checked against a list of trusted prefixes using String.startsWith() on the raw string, while the browser applies RFC 3986 dot-segment normalisation before navigating, so a value such as https://github.com/adoptium/temurin/../../attacker/malware/releases/download/v1/jdk.exe passes the check but resolves to an attacker-controlled repository. A victim who follows a crafted adoptium.net link is shown the genuine \"Thank you for downloading Eclipse Temurin\" page while their browser downloads a binary of the attacker's choosing","status":"published","published":"2026-10-15T13:28:42.59Z","modified":"2026-10-28T02:30:27.44744055Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-494","CWE-601"],"updated_at":"2026-11-02T15:45:20.931171Z"}]}}