CVE-2026-42525 PUBLISHED

Assigner: jenkins
Reserved: 28.04.2026 Published: 29.04.2026 Updated: 29.04.2026

Jenkins Microsoft Entra ID (previously Azure AD) Plugin 666.v6060de32f87d and earlier does not restrict the redirect URL after login, allowing attackers to perform phishing attacks.

Product Status

Vendor Jenkins Project
Product Jenkins Microsoft Entra ID (previously Azure AD) Plugin
Versions Default: unaffected
  • affected from 0 to 666.v6060de32f87d (incl.)

References