VULNERABILITY INTELLIGENCE

CVE-2026-53440

CVSS score4.3 MEDIUM
EPSS probability0.23%
CISA KEVNot currently listed
Published2026-06-10
Last modified2026-10-26
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Description

Jenkins 2.567 and earlier, LTS 2.555.2 and earlier does not ensure that the "from" parameter in the "Delegate to servlet container" security realm is safe to redirect to after login, allowing attackers to perform phishing attacks by redirecting users to an attacker-controlled domain.

Weakness classification

  • 134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-601

Primary references