CVE-2026-93649 Eclipse Foundation CVE debrief

Who should care

Defenders responsible for the Adoptium Temurin deployment, security teams monitoring for suspicious activity, and developers using the Adoptium Temurin package should assess exposure and prioritize remediation.

Why it matters

The vulnerability in the Eclipse Adoptium website allows an attacker to redirect users to a malicious URL, potentially leading to the download of attacker-controlled binaries. Defenders should prioritize remediation and monitor for suspicious activity.

• Potential download of attacker-controlled binaries
• Possible exploitation of vulnerable Adoptium Temurin deployments
• Required verification of URL validation logic
• Necessity for security teams to monitor for suspicious activity

Technical summary

The Eclipse Adoptium website is vulnerable to a URL redirection attack. The post-download page /[locale]/download takes a download URL from the 'link' query parameter and automatically navigates to it with a meta http-equiv='refresh'. The URL is checked against a list of trusted prefixes using String.startsWith() on the raw string, while the browser applies RFC 3986 dot-segment normalisation before navigating. This allows an attacker to redirect users to a malicious URL, potentially leading to the download of attacker-controlled binaries. The issue arises from the lack of proper URL normalization and validation, enabling attackers to craft malicious URLs that pass the trust check but resolve to attacker-

Defensive priority

High

Recommended defensive actions

• Review and update the URL validation logic to prevent protocol-relative URL attacks
• Implement proper URL normalization before navigating to the download URL
• Monitor for suspicious activity on the Adoptium Temurin download page
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The Eclipse Adoptium website is vulnerable to a URL redirection attack. The post-download page /[locale]/download takes a download URL from the 'link' query parameter and automatically navigates to it with a meta http-equiv='refresh'. The URL is checked against a list of trusted prefixes using String.startsWith() on the raw string, while the browser applies RFC 3986 dot-segment normalisation before navigating.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.