CVE-2026-44501 — DataHub OIDC REDIRECT_URL Cookie Deserialization Vulnerability

Description (CNA)

DataHub is an open-source metadata platform. Prior to 1.5.0.3, The DataHub frontend (datahub-frontend-react) deserializes attacker-controlled Java objects from the REDIRECT_URL HTTP cookie during the OIDC callback flow, with no integrity protection (no HMAC, no encryption). This is a Deserialization of Untrusted Data vulnerability (CWE-502) affecting the GET /callback/oidc endpoint. Successful exploitation requires a valid user account in the configured OIDC identity provider This vulnerability is fixed in 1.5.0.3.

Affected (CNA)

Vendor / product	Versions
datahub-project / datahub	affected < 1.5.0.3

CWE

CWE-502

References

https://github.com/datahub-project/datahub/security/advisories/GHSA-rjf9-p49v-42c4

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.