GitHub Advisoryadvisory · Maven

GHSA-463r-5m89-4xfr Jenkins Open Redirect Through Newline/Tab Characters in Redirect URL

MEDIUM Published 2026-06-10 Modified 2026-08-27 Official page ↗
Aliases
CVE-2026-53437
Ecosystem
Maven
Packages
org.jenkins-ci.main:jenkins-core
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Weaknesses
CWE-601
Reviewed
2026-08-13

Affected packages

• Maven org.jenkins-ci.main:jenkins-core: < 2.555.3 → fixed in 2.555.3 • Maven org.jenkins-ci.main:jenkins-core: >= 2.556, < 2.568 → fixed in 2.568

Description

Jenkins 2.567 and earlier, LTS 2.555.2 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins when it contains tab or newline characters between `//`, allowing attackers to perform phishing attacks.

Related

Alias · CVE (1)

  • CVE-2026-53437 Jenkins 2.567 and earlier, LTS 2.555.2 and earlier improperly determines that a redirect URL after login is legitimately pointing to… vulnerability

Weakness · CWE (1)

  • CWE-601 URL Redirection to Untrusted Site weakness

References