Jenkins Entra ID Plugin CVE-2026-42525

The victim must click an attacker-crafted Jenkins login URL containing a malicious redirect parameter (UI:R per CVSS vector). The target Jenkins instance must have the Microsoft Entra ID Plugin (version 666.v6060de32f87d or earlier) installed and configured as the authentication provider - instances using other auth mechanisms (LDAP, built-in Jenkins auth, other SSO plugins) are not affected. The attacker requires no authentication or privileges on the Jenkins server itself (PR:N). Exploitation is limited by the need for social engineering to deliver the crafted URL and the victim's willingness to interact; the flaw cannot be triggered passively or automatically against idle users.

The CVSS 3.1 score of 4.3 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) accurately reflects a moderate-impact, network-accessible phishing vector that nonetheless requires victim interaction and produces no direct confidentiality or availability impact. Real-world risk is further tempered by multiple converging signals: EPSS sits at 0.03% (8th percentile), indicating very low observed exploitation probability; SSVC classification marks exploitation as 'none' and the flaw as non-automatable with only partial technical impact; there is no CISA KEV listing; and no public proof-of-concept has been identified. The primary threat model is targeted spear-phishing against Jenkins administrators or developers with Entra ID SSO enabled - an attacker who can deliver a crafted URL to a victim and harvest credentials from a replica login page. Despite the ease of constructing such a URL (AC:L, PR:N), the dependency on user interaction (UI:R) and the absence of direct system compromise limit automated, large-scale exploitation.

An attacker crafts a Jenkins login URL embedding a redirect parameter pointing to an attacker-controlled phishing page that mimics an internal portal (e.g., a fake Confluence or Vault login). The attacker delivers this URL via email or Slack to a Jenkins developer; the victim authenticates normally through Microsoft Entra ID, after which the unvalidated plugin redirects them to the phishing site, where their secondary credentials are harvested. No proof-of-concept code has been publicly identified at the time of analysis.