CVE-2026-16336 trinodb trino OAuth2/OIDC ExternalUriInfo.java redirect
Attackers can exploit an open redirect in Trino's OAuth2/OIDC component to redirect users to malicious sites, potentially facilitating phishing attacks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-16336?
CVE-2026-16336 is a medium-severity vulnerability in trinodb trino, published on 21 Jul 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
A vulnerability was found in trinodb trino 481. Affected is an unknown function of the file core/trino-main/src/main/java/io/trino/server/ExternalUriInfo.java of the component OAuth2/OIDC. Performing a manipulation of the argument redirect_uri results in open redirect. It is possible to initiate the attack remotely. The project was informed of the problem early through an issue report but has not responded yet.
Weakness: CWE-601
Which versions are affected by CVE-2026-16336?
How do I fix CVE-2026-16336?
No fix has been published for CVE-2026-16336 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-16336 being exploited?
There is no known exploitation of CVE-2026-16336 in the wild and no public exploit code.
Sources
Also known as GHSA-rf2w-6p6m-3cqv.