CVE-2026-53437

[CVE catalog]

Severity

High · CVSS 7.4CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

Published

Jun 10, 2026, 1:05:58 PM UTC

Source

[NVD] · [CVE record]

EPSS

0.47% · Oct 27, 2026

A flaw was found in Jenkins. This vulnerability allows a remote attacker to perform phishing attacks by crafting a malicious redirect URL. The flaw occurs because Jenkins improperly validates redirect URLs after login, specifically when tab or newline characters are present between the `//` in the URL. This can trick users into visiting malicious sites, potentially leading to credential theft or other security compromises. jenkins: Jenkins: Phishing attack via improper redirect URL validation This is an Important vulnerability in Jenkins that allows remote attackers to conduct phishing attacks. The flaw stems from improper validation of redirect URLs after login, specifically when tab or newline characters are present, which can be exploited to redirect users to malicious sites. This could lead to credential theft and other security compromises for users interacting with affected Jenkins instances in Red Hat OpenShift Developer Tools & Services. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.