EUVD-2026-26227Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Network-delivered phishing redirect with no attacker privileges; user interaction required; impact limited to low integrity with no confidentiality or availability loss.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
Jenkins Microsoft Entra ID (previously Azure AD) Plugin 666.v6060de32f87d and earlier does not restrict the redirect URL after login, allowing attackers to perform phishing attacks.
AnalysisAI
Open redirect in the Jenkins Microsoft Entra ID Plugin (formerly Azure AD Plugin) version 666.v6060de32f87d and earlier allows network-accessible phishing attacks against Jenkins users. The plugin fails to validate the post-login redirect URL, enabling an attacker to craft a legitimate-looking Jenkins authentication link that silently forwards victims to an attacker-controlled site after successful Entra ID login. No active exploitation is confirmed (SSVC: none; EPSS 0.03%, 8th percentile), and the vendor has released a patch per the April 2026 Jenkins security advisory.
Technical ContextAI
The affected component is the Jenkins Microsoft Entra ID Plugin (CPE: cpe:2.3:a:jenkins_project:jenkins_microsoft_entra_id_(previously_azure_ad)_plugin:*:*:*:*:*:*:*:*), which integrates Jenkins CI/CD with Microsoft Entra ID (formerly Azure Active Directory) for SSO/OAuth-based authentication. CWE-601 (URL Redirection to Untrusted Site - Open Redirect) describes the root cause: the plugin accepts an externally-supplied redirect parameter after the authentication callback without validating that the destination URL belongs to the trusted Jenkins origin. This is a classic OAuth/SSO post-login redirect flaw where the relying-party application fails to enforce an allowlist of valid redirect destinations, making the authenticated session a launchpad for social engineering.
RemediationAI
Update the Jenkins Microsoft Entra ID Plugin to a version released after 666.v6060de32f87d, as a patch is confirmed available per the Jenkins security advisory at https://www.jenkins.io/security/advisory/2026-04-29/#SECURITY-3760. The exact fixed version number is not specified in the available intelligence data and should be confirmed in the Jenkins Update Center or the advisory itself. If an immediate upgrade is not feasible, a compensating control is to configure a network or reverse-proxy layer (e.g., nginx) to reject login requests containing redirect parameters pointing to external domains - though this may break legitimate deep-link redirects and should be tested carefully. Additionally, security awareness training for Jenkins users about verifying post-login URL destinations reduces phishing effectiveness. There are no known side effects to upgrading the plugin beyond standard plugin compatibility validation.
More in Open Redirect
View allA malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL ca
GFI Kerio Control versions 9.2.5 through 9.4.5 contain an HTTP response splitting vulnerability in the dest parameter of
PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect
Multiple open redirect vulnerabilities in Apache Struts 2.0.0 through 2.3.15 allow remote attackers to redirect users to
Open redirect vulnerability in age-verification.php in the Age Verification plugin 0.4 and earlier for WordPress allows
Open redirect vulnerability in Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.29, 8.x before 8.0.0.18, 9.0 b
Vulnerability in the Oracle Applications Framework component of Oracle E-Business Suite (subcomponent: Popup windows (li
Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware 10.1.4.3
Flarum is open source discussion platform software. Rated medium severity (CVSS 6.5), this vulnerability is remotely exp
Open redirect vulnerability in Novius OS 5.0.1 (Elche) allows remote attackers to redirect users to arbitrary web sites
Open redirect vulnerability in the Redirect function in stageshow_redirect.php in the StageShow plugin before 5.0.9 for
Nteract v.0.28.0 was discovered to contain a remote code execution (RCE) vulnerability via the Markdown link. Rated crit
Share
External POC / Exploit Code
Leaving vuln.today