NetSight
IP …
medium4.3

CVE-2026-53437

Jenkins 2.567 and earlier, LTS 2.555.2 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins when it contains t…

Impact

Jenkins 2.567 and earlier, LTS 2.555.2 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins when it contains tab or newline characters between `//`, allowing attackers to perform phishing attacks.

Affected packages

EcosystemPackageAffectedFixed in
mavenorg.jenkins-ci.main:jenkins-core< 2.555.32.555.3

Affected products

VendorProductAffected versions
JenkinsJenkins
before 2.555.3
before 2.568

Weakness classification

CWE-601

References