Security Flaw in Jenkins Affects User Redirects

CVE-2025-27625

What is CVE-2025-27625?

In Jenkins versions 2.499 and earlier, as well as LTS 2.492.1 and earlier, an issue arises with redirects that begin with backslash (\) characters. These redirects are incorrectly deemed safe, presenting a security risk. Attackers can exploit this flaw by tricking users into navigating a Jenkins URL that redirects them to a malicious site. This manipulation occurs due to how browsers interpret these characters in scheme-relative redirects, thereby facilitating phishing attempts and endangering user credentials.

References