Eclipse Adoptium Temurin Download Page /[locale]/download String.startsWith link redirect

Summaryinfo

A vulnerability has been found in Eclipse Adoptium Temurin and classified as problematic. The impacted element is the function String.startsWith of the file /[locale]/download of the component Download Page. The manipulation of the argument Link leads to redirect. This vulnerability is uniquely identified as CVE-2026-93649. The attack is possible to be carried out remotely. No exploit exists. It is recommended to apply a patch to fix this issue.

Detailsinfo

A vulnerability was found in Eclipse Adoptium Temurin (the affected version unknown) and classified as problematic. This issue affects the function String.startsWith of the file /[locale]/download of the component Download Page. The manipulation of the argument link with an unknown input leads to a redirect vulnerability. Using CWE to declare the problem leads to CWE-601. A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks. Impacted is integrity. The summary by CVE is:

In the Eclipse Adoptium website (adoptium.net), in every deployment built from commit 0b24ea1 (2025-06-18) up to the fix in commit cbb53cf (2026-09-24), the post-download page /[locale]/download takes a download URL from the "link" query parameter and automatically navigates to it with a meta http-equiv="refresh". The URL is checked against a list of trusted prefixes using String.startsWith() on the raw string, while the browser applies RFC 3986 dot-segment normalisation before navigating, so a value such as https://github.com/adoptium/temurin/../../attacker/malware/releases/download/v1/jdk.exe passes the check but resolves to an attacker-controlled repository. A victim who follows a crafted adoptium.net link is shown the genuine "Thank you for downloading Eclipse Temurin" page while their browser downloads a binary of the attacker's choosing

It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2026-93649 since 09/18/2026. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. It demands that the victim is doing some kind of user interaction. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1204.001 according to MITRE ATT&CK.

Applying the patch cbb53cf is able to eliminate this problem.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• Eclipse

Name

• Adoptium Temurin

License

• open-source

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion