Jenkins Keycloak Authentication Plugin
Monthly
Open redirect in the Jenkins Keycloak Authentication Plugin 2.4.1 and earlier lets an unauthenticated attacker craft a login URL whose post-authentication redirect target is not validated, sending a victim who completes Keycloak login to an arbitrary external site (CWE-601, vendor CVSS 4.3). Only Jenkins instances where this plugin is installed and configured as the active authentication realm are affected, and exploitation requires the victim to click the supplied link and finish authentication (UI:R), so impact is confined to phishing and credential-harvesting rather than direct access to Jenkins. No public exploit code identified at time of analysis and no CISA KEV listing; the primary limiting factors are the mandatory user interaction and the low-integrity impact assessed in the vector AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N.
Open redirect in the Jenkins Keycloak Authentication Plugin 2.4.1 and earlier lets an unauthenticated attacker craft a login URL whose post-authentication redirect target is not validated, sending a victim who completes Keycloak login to an arbitrary external site (CWE-601, vendor CVSS 4.3). Only Jenkins instances where this plugin is installed and configured as the active authentication realm are affected, and exploitation requires the victim to click the supplied link and finish authentication (UI:R), so impact is confined to phishing and credential-harvesting rather than direct access to Jenkins. No public exploit code identified at time of analysis and no CISA KEV listing; the primary limiting factors are the mandatory user interaction and the low-integrity impact assessed in the vector AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N.