Jenkins Redirect Vulnerability Allows Phishing Attacks

CVE-2026-53437

What is CVE-2026-53437?

The identified vulnerability in Jenkins affects versions 2.567 and earlier, including LTS 2.555.2 and earlier. It arises from improper validation of redirect URLs during the login process. Specifically, the presence of tab or newline characters within the URL can lead Jenkins to mistakenly validate it as a legitimate redirect. This flaw opens the door for attackers to execute phishing attacks, potentially deceiving users into providing sensitive information under false pretenses. Users of affected versions should seek to update to secure versions promptly to mitigate these risks.

References