Medium · 4.3 CVE-2026-92141 EUVD-2026-80765GHSA-4f55-vrqg-62c7

Jenkins Keycloak Authentication Plugin 2.4.1 and earlier does not restrict the redirect URL after login, allowing attackers to perform phis…

Published Sep 16, 2026 · Updated Sep 16, 2026 · Assigned by jenkins

Vendor: Jenkins Project Product: Jenkins Keycloak Authentication Plugin Category: Web / CMS

Description

Jenkins Keycloak Authentication Plugin 2.4.1 and earlier does not restrict the redirect URL after login, allowing attackers to perform phishing attacks.

Affected products

Vendor	Product	Affected	Fixed
Jenkins Project	Jenkins Keycloak Authentication Plugin	≤ 2.4.1	—

Advisories 1

WID-SEC-2026-3428 Jenkins Plugins: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 21, 2026

References

Jenkins Security Advisory 2026-09-16 vendor-advisory