A flaw in the Adoptium website’s download page allows an attacker to supply a specially crafted URL in the link query parameter that bypasses the site’s whitelist check. The check uses String.startsWith() on the raw input before the browser normalises the URI according to RFC 3986. As a result, a URL that appears to satisfy the trusted prefix can resolve to an attacker‑controlled domain, causing the victim’s browser to download an arbitrary binary. This could lead to execution of malicious code on the victim’s machine and compromise confidentiality, integrity, and availability of the target system.

The vulnerability exists in deployments of the Eclipse Foundation: Adoptium Temurin website, built from commit 0b24ea1 (2025‑06‑18) up to the fix in commit cbb53cf (2026‑09‑24). All users accessing the */[locale]/download* endpoint during this period are affected.

Because the daemon accepts a URL directly from the client, the attack interface is simple – a single crafted link can trigger the download. The CVSS score of 7.5 indicates a high severity, while a low EPSS score (< 1 %) suggests limited current exploitation. The vulnerability is not listed in the CISA KEV catalog. Nevertheless, the impact is severe if exploited, allowing the delivery of arbitrary binaries that the victim’s browser will download and potentially execute. The primary attack vector is phishing or compromised links that embed the malicious download URL.