The DataHub front‑end deserializes attacker‑controlled Java objects from the REDIRECT_URL cookie during the OIDC callback flow without any integrity protection, allowing an attacker to potentially execute arbitrary code or hijack a user session. This flaw is a classic Deserialization of Untrusted Data vulnerability (CWE‑502).

The vulnerability affects the datahub-project datahub platform, specifically versions prior to 1.5.0.3, in the datahub‑frontend‑react component that processes the GET /callback/oidc endpoint.

With a CVSS score of 4.3 the risk is moderate. EPSS is not available and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires a valid user account in the configured OIDC identity provider and the attacker must persuade the front‑end to read a malicious REDIRECT_URL cookie during the normal OIDC callback flow. The attack vector is thus implicit in legitimate authentication traffic and could be triggered by manipulating the cookie sent from a client device manually or via a phishing URI.