CVE-2026-42525

MediumCVSS 4.3

Published: 29/04/2026(UTC)Updated: 26/10/2026(UTC)Translated: 26/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.21%

11th percentile - higher than 11% of all known CVEs

Summary

Jenkins Microsoft Entra ID (previously Azure AD) Plugin 666.v6060de32f87d and earlier does not restrict the redirect URL after login, allowing attackers to perform phishing attacks.

Risk Assessment

An attacker could exploit the open redirect to direct users to malicious phishing pages impersonating login, potentially leading to credential theft.

Recommendation

Upgrade the Jenkins Microsoft Entra ID plugin to a version later than 666.v6060de32f87d when available. Until then educate users about phishing and monitor for unusual redirects.

Other vulnerabilities in Jenkins Microsoft Entra ID Plugin

CVE-2026-84672High
Vulnerability in Jenkins Microsoft Entra ID Plugin 710.v0b_ff8e9cc2d2 and earlier grants Entra group permissions using both the group's unique object ID and its display name, allowing attackers who can create an Entra group with a colliding display name to gain permissions configured for a privileged group.

Original NVD description (English source)

Jenkins Microsoft Entra ID (previously Azure AD) Plugin 666.v6060de32f87d and earlier does not restrict the redirect URL after login, allowing attackers to perform phishing attacks.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS