Moole Vulnerability Database

Find real vulnerabilities before they ship

Medium

CVE-2026-42525

Jenkins Microsoft Entra ID (previously Azure AD) Plugin 666.v6060de32f87d and earlier does not restrict the redirect URL after login, allowing attackers to perform phishing attacks.

VectorNETWORK

PublishedApr 29, 2026, 14:16

Published Byjenkinsci-cert@googlegroups.com

Base Score

Score4.3

Affected Versions

Package (Ecosystem)IntroducedFixedLimit

org.jenkins-ci.plugins:azure-ad(Maven)0667.v4c5827aN/A

References

https://www.jenkins.io/security/advisory/2026-04-29/#SECURITY-3760

Weakness Type

CWE-601

CVSS Metrics

Base Score

4.3

Vector String

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Base SeverityMedium

Version

3.1

Attack Vector (AV)

NETWORK