EUVD-2026-46147
GHSA-rf2w-6p6m-3cqv
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible OAuth2 endpoint with no privileges required; user interaction mandatory to trigger redirect; impact limited to low integrity via phishing redirect, no confidentiality or availability loss.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
1DescriptionCVE.org
A vulnerability was found in trinodb trino 481. Affected is an unknown function of the file core/trino-main/src/main/java/io/trino/server/ExternalUriInfo.java of the component OAuth2/OIDC. Performing a manipulation of the argument redirect_uri results in open redirect. It is possible to initiate the attack remotely. The project was informed of the problem early through an issue report but has not responded yet.
AnalysisAI
Open redirect in Trino 481's OAuth2/OIDC authentication component allows remote, unauthenticated attackers to manipulate the redirect_uri parameter in ExternalUriInfo.java, redirecting authenticated users to attacker-controlled external sites. Exploitation requires user interaction - a victim must follow a crafted authentication URL - making this primarily a phishing and token-harvesting enabler rather than a direct system compromise vector. No active exploitation has been confirmed (not in CISA KEV), no public exploit code exists, and the trinodb project had not responded to the responsible disclosure report at time of analysis.
Technical ContextAI
Trino (formerly PrestoSQL) is a distributed SQL query engine used for analytics across heterogeneous data sources. The vulnerable code resides in core/trino-main/src/main/java/io/trino/server/ExternalUriInfo.java, which handles URI construction within the OAuth2/OIDC authentication flow. CWE-601 (Open Redirect) arises when user-supplied input - here the redirect_uri parameter - is used to construct redirect targets without validation against an allowlist. In OAuth2/OIDC flows, the redirect_uri is critical: it specifies where the authorization server returns the user (and authorization code) after successful authentication. Failure to validate this parameter against pre-registered or explicitly allowed URIs enables an attacker to substitute a malicious destination, potentially capturing authorization codes or access tokens mid-flow. The CPE string cpe:2.3:a:trinodb:trino:*:*:*:*:*:*:*:* with a wildcard version qualifier suggests the underlying flaw may span multiple Trino releases, though version 481 is the confirmed reported version.
RemediationAI
No vendor-released patch has been identified at time of analysis - the project was notified via GitHub issue #29754 but had not responded at the time of reporting. Operators should monitor https://github.com/trinodb/trino/issues/29754 and https://github.com/trinodb/trino/ for patch availability. As an immediate compensating control, if OAuth2/OIDC authentication is not operationally required, disabling it in Trino's configuration eliminates the attack surface entirely, though this will force a fallback to alternative authentication mechanisms. If OAuth2/OIDC must remain enabled, restrict network access to Trino's coordinator authentication endpoints (typically HTTPS on port 8443) to trusted internal networks only, reducing the attacker's ability to deliver crafted links that reach exposed endpoints. Additionally, enforcing strict redirect_uri registration at the OAuth2/OIDC identity provider level (requiring exact URI matches rather than prefix or pattern matching) can mitigate the impact even if Trino itself does not validate the parameter - this is an IdP-side control with no adverse effect on normal operation.
Oracle Java SE 7 Update 6 and earlier contains multiple sandbox bypass vulnerabilities via the ClassFinder and forName m
Remote code execution in IBM Sterling B2B Integrator, Sterling Integrator, and Tivoli Common Reporting allows unauthenti
Java Runtime Environment sandbox bypass via incorrect image channel verification in 2D component allows remote unauthent
Oracle Java SE JDK/JRE 7 and 6 Update 27 and earlier allows remote code execution with complete system compromise throug
JBoss Seam 2 in Red Hat JBoss EAP 4.3.0 fails to sanitize JBoss Expression Language inputs, allowing remote attackers to
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 up
Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Up
The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allow
Remote unauthenticated attackers can execute arbitrary code on Adobe ColdFusion servers through Java deserialization fla
The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during
Vendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today