---
id: CVE-2026-93649
title: >-
  In the Eclipse Adoptium website (adoptium.net), in every deployment built from
  commit 0b24ea1 (2025-06-18) up to the fix in commit cbb53cf (2026-09-24), the
  post-download page /[locale]/download takes a download URL from the "link"
  query…
summary: >-
  In the Eclipse Adoptium website (adoptium.net), in every deployment built from
  commit 0b24ea1 (2025-06-18) up to the fix in commit cbb53cf (2026-09-24), the
  post-download page /[locale]/download takes a download URL from the "link"
  query…
severity: none
cwe:
  - CWE-494
  - CWE-601
vendor: Eclipse Foundation
product: Adoptium Temurin
affected:
  - adoptium_temurin < 1f9753c
published: '2026-10-15'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T14:41:34.110'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-93649'
references:
  - url: >-
      https://github.com/adoptium/adoptium.net/commit/cbb53cf4a41f068a70902217473d7e2fe5d6c6ad
    label: emo@eclipse.org
  - url: >-
      https://github.com/adoptium/adoptium.net/security/advisories/GHSA-f228-m952-5r6w#event-1046947
    label: emo@eclipse.org
  - url: 'https://gitlab.eclipse.org/security/cve-assignment/-/work_items/313'
    label: emo@eclipse.org
tags:
  - nvd
  - cve.org
ingestedAt: '2026-10-15T14:07:30.110Z'
---

## Overview

In the Eclipse Adoptium website (adoptium.net), in every deployment built from commit 0b24ea1 (2025-06-18) up to the fix in commit cbb53cf (2026-09-24), the post-download page /[locale]/download takes a download URL from the "link" query parameter and automatically navigates to it with a meta http-equiv="refresh". The URL is checked against a list of trusted prefixes using String.startsWith() on the raw string, while the browser applies RFC 3986 dot-segment normalisation before navigating, so a value such as https://github.com/adoptium/temurin/../../attacker/malware/releases/download/v1/jdk.exe passes the check but resolves to an attacker-controlled repository. A victim who follows a crafted adoptium.net link is shown the genuine "Thank you for downloading Eclipse Temurin" page while their browser downloads a binary of the attacker's choosing

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.