Executive brief
Trino, a distributed SQL query engine, contains a security flaw in how it handles user logins via OAuth2 and OIDC. An attacker can manipulate login requests to redirect users to a malicious website instead of the intended destination. This could be used in phishing campaigns to trick users into providing sensitive information or to intercept authentication codes if the identity provider is also misconfigured.
Technical details
An open redirect vulnerability exists in Trino (formerly PrestoSQL) version 481 within the OAuth2/OIDC authentication component. The application dynamically constructs the OAuth2 callback URI using untrusted request headers such as 'Host', 'X-Forwarded-Host', or 'X-Forwarded-Proto' without validating them against a server-side allowlist. A remote attacker can exploit this by crafting a malicious link that, when followed by a victim, redirects them to an arbitrary external domain. If the configured Identity Provider (IdP) has loose redirect URI matching rules, this could further lead to the leakage of authorization codes to attacker-controlled endpoints. The vulnerability is located in the ExternalUriInfo.java file.
Affected products
- trinodb Trino 481
Timeline
- 2026-06-04: disclosed: Issue reported to the project via GitHub
- 2026-07-21: advisory: CVE published via VulDB/NVD