Submeter #858687: GitHub trino 481 Open Redirect

### Trino version

476

### Please describe the bug

## Description

Trino dynamically constructs the OAuth2/OIDC callback URI from the incoming request context and passes it directly as the OAuth `redirect_uri`. There does not appear to be a Trino-side allowlist or exact validation against a configured canonical callback URI.

If an attacker can influence the externally observed request URI, for example via `Host`, `X-Forwarded-Host`, `X-Forwarded-Proto`, or a reverse proxy configuration, Trino may generate an OAuth authorization request whose `redirect_uri` points to an attacker-controlled origin.

If the configured Identity Provider accepts this modified `redirect_uri` for Trino's `client_id` due to wildcard, prefix, subdomain, or otherwise loose redirect URI matching, the authorization code can be sent to the attacker-controlled callback endpoint.

This is especially concerning because Trino later exchanges the authorization code using its configured OAuth client credentials.

This issue is conditional on deployment and IDP configuration, but the source-level behavior is that Trino does not pin or validate the callback URI before sending it to the IDP.

## Affected code
### Web UI OAuth challenge

`core/trino-main/src/main/java/io/trino/server/ui/OAuth2WebUiAuthenticationFilter.java`

```java
request.abortWith(service.startOAuth2Challenge(
request.getUriInfo().getBaseUri().resolve(CALLBACK_ENDPOINT),
Optional.empty()));
```
`core/trino-main/src/main/java/io/trino/server/security/oauth2/OAuth2TokenExchangeResource.java`

## CLI / external authentication token exchange

```java
return service.startOAuth2Challenge(
externalUriInfo.absolutePath(CALLBACK_ENDPOINT),
Optional.ofNullable(authIdHash));
```

### Forwarded prefix handling
`core/trino-main/src/main/java/io/trino/server/ExternalUriInfo.java`

```java
this(uriInfo, requireNonNull(httpHeaders, "httpHeaders is null")
.getHeaderString(X_FORWARDED_PREFIX));

return new ExternalUriBuilder(uriInfo.getBaseUriBuilder()
.replacePath(forwardedPrefix)
.replaceQuery(""));
```

## Security impact

If the IDP accepts the attacker-influenced redirect_uri, a victim completing OAuth login can cause the authorization code to be sent to an attacker-controlled callback endpoint.

Depending on the flow, the attacker may then be able to forward the code and signed state back to Trino's callback endpoint and have Trino exchange the code using its configured client credentials.

## Expected behavior

Trino should not derive OAuth callback URIs solely from untrusted request context. It should either:

require a configured canonical external OAuth callback URI, or validate the dynamically constructed callback URI against an exact allowlist, including scheme, host, port, and path.

Invalid or untrusted forwarded host/proto/prefix values should not be allowed to influence OAuth redirect_uri.

• Fonte: ⚠️ https://github.com/trinodb/trino/issues/29754
• Utilizador: 0Xrry (UID 86188)
• Submissão: 15/06/2026 15h18 (há 1 mês)
• Moderação: 20/07/2026 20h06 (1 month later)
• Estado: Aceite
• Entrada VulDB: 380710 [trinodb trino 481 OAuth2/OIDC ExternalUriInfo.java redirect_uri Redirect]
• Pontos: 20