DataHub's frontend (datahub-frontend-react) prior to version 1.5.0.3 improperly deserializes untrusted Java objects from the REDIRECT_URL HTTP cookie during the OIDC callback endpoint (/callback/oidc). This deserialization occurs without any integrity checks such as HMAC or encryption, leading to a CWE-502 vulnerability. Successful exploitation requires that the attacker has a valid user account in the configured OIDC identity provider. The vulnerability is resolved in DataHub version 1.5.0.3.

An attacker with a valid user account in the OIDC identity provider can supply malicious serialized Java objects via the REDIRECT_URL cookie, potentially causing unsafe deserialization in the frontend. The CVSS vector indicates network attack vector, low attack complexity, required privileges, no user interaction, and limited confidentiality impact. There is no impact on integrity or availability reported. No known exploits in the wild have been documented.

Upgrade DataHub to version 1.5.0.3 or later, where this vulnerability is fixed. Since no official patch links or vendor advisory are provided, confirm the upgrade path from the DataHub project releases. No temporary or alternative mitigations are indicated. Patch status is confirmed by the description stating the issue is fixed in 1.5.0.3.