Open Redirect Vulnerability in Jenkins Keycloak Authentication Plugin
CVE-2026-92141

4.3MEDIUM

Key Information:

Vendor

Jenkins
Status
Jenkins Keycloak Authentication Plugin
Vendor
CVE Published:
16 September 2026

What is CVE-2026-92141?

The Jenkins Keycloak Authentication Plugin prior to version 2.4.1 contains an open redirect vulnerability that does not validate the redirect URL after user authentication. This flaw can be exploited by malicious actors to redirect users to arbitrary URLs, potentially facilitating phishing attempts and compromising user credentials. Organizations utilizing this plugin should upgrade to the latest version to mitigate the risk.

Affected Version(s)

Jenkins Keycloak Authentication Plugin 0 <= 2.4.1

References

https://www.jenkins.io/security/advisory/2026-09-16/#SECU...
vendor-advisory

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.