Security Flaw in Jenkins Affects User Redirects

CVE-2025-27625

Summary

In Jenkins versions 2.499 and earlier, as well as LTS 2.492.1 and earlier, an issue arises with redirects that begin with backslash (\) characters. These redirects are incorrectly deemed safe, presenting a security risk. Attackers can exploit this flaw by tricking users into navigating a Jenkins URL that redirects them to a malicious site. This manipulation occurs due to how browsers interpret these characters in scheme-relative redirects, thereby facilitating phishing attempts and endangering user credentials.

References