Description

Jenkins 2.567 and earlier, LTS 2.555.2 and earlier does not ensure that the "from" parameter in the "Delegate to servlet container" security realm is safe to redirect to after login, allowing attackers to perform phishing attacks by redirecting users to an attacker-controlled domain.

Remediation

References

CVE-2026-53440

Related Vulnerabilities

Oracle JRE CVE-2017-10388 Vulnerability (CVE-2017-10388)

phpMyAdmin Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2009-3696)

SharePoint Download of Code Without Integrity Check Vulnerability (CVE-2020-1452)

Joomla Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2017-16633)

Envoy Proxy Improper Input Validation Vulnerability (CVE-2019-9900)

Severity

Medium

Classification

CVE-2026-53440 CWE-601 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Tags

Missing Update Known Vulnerabilities