Cross-Site Scripting in Eclipse Adoptium Affects Download Functionality

CVE-2026-93649

What is CVE-2026-93649?

In the Eclipse Adoptium platform, a vulnerability exists where the download page automatically redirects users to URLs derived from a query parameter. This mechanism utilizes a string check against trusted prefixes, which is insufficient due to the browser’s RFC 3986 normalization. As a result, an attacker can manipulate the URL to point to malicious resources while misleading victims into believing they are downloading a legitimate binary. This flaw affects all deployments from commit 0b24ea1 to cbb53cf, posing a significant security risk to users who rely on the platform for software downloads.

References