Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
4.3

Jenkins login redirect can be spoofed using hidden characters

CVE-2026-53437 · published 4 months ago
Summary

Jenkins versions up to 2.567 (and the corresponding LTS releases) may treat a specially crafted URL after a user logs in as safe, even if it contains tab or newline characters. This can let an attacker send users to a fake site that appears to be Jenkins, increasing the chance of phishing. Update Jenkins to a newer release to have the redirect check correctly handle these characters.

What to do
  • Update jenkins-ci org.jenkins-ci.main:jenkins-core to version 2.555.3.
  • Update jenkins-ci org.jenkins-ci.main:jenkins-core to version 2.568.
  • Update jenkins to version 2.568.0.
  • Update org.jenkins-ci.main:jenkins-core to version 2.555.3.
  • Update org.jenkins-ci.main:jenkins-core to version 2.568.
Affected software
Ecosystem VendorProductAffected versions
– jenkins project jenkins All versions
– jenkins jenkins < 2.555.3
< 2.568
cpe:2.3:a:jenkins:jenkins:*:*:*:*:lts:*:*:*
maven jenkins-ci org.jenkins-ci.main:jenkins-core < 2.555.3
>= 2.556, < 2.568
Fix: upgrade to 2.555.3
Bitnami – jenkins >= 2.556.0, < 2.568.0
Fix: upgrade to 2.568.0
maven – org.jenkins-ci.main:jenkins-core < 2.555.3
>= 2.556, < 2.568
Fix: upgrade to 2.555.3
Original advisory text
Jenkins Open Redirect Through Newline/Tab Characters in Redirect URL
Jenkins 2.567 and earlier, LTS 2.555.2 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins when it contains tab or newline characters between `//`, allowing attackers to perform phishing attacks.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
4.3 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-601Open Redirect
Timeline
Published10 Jun 2026
Updated4 Nov 2026
First seen10 Jun 2026
Sources
CVE-2026-53437 · NVD
CVE-2026-53437 · MITRE
GHSA-463r-5m89-4xfr · GHSA
GHSA-463r-5m89-4xfr · OSV
BIT-jenkins-2026-53437 · OSV
CVE-2026-53437 · OSV
Track software like this
Free during beta