CVE-2026-53437

MediumCVSS 4.3/10Last modified Oct 26, 2026

Description

Jenkins 2.567 and earlier, LTS 2.555.2 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins when it contains tab or newline characters between `//`, allowing attackers to perform phishing attacks.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-601

Affected software

Vendor	Product	Versions
Jenkins Project	Jenkins	—
Red Hat	OpenShift Developer Tools and Services 4.12	—
Red Hat	OpenShift Developer Tools and Services 4.13	—
Red Hat	OpenShift Developer Tools and Services 4.14	—
Red Hat	OpenShift Developer Tools and Services 4.15	—
Red Hat	OpenShift Developer Tools and Services 4.16	—
Red Hat	OpenShift Developer Tools and Services 4.17	—
Red Hat	OpenShift Developer Tools and Services 4.18	—
Red Hat	OpenShift Developer Tools and Services 4.19	—
Red Hat	OpenShift Developer Tools and Services 4.20	—
Red Hat	OpenShift Developer Tools and Services 4.21	—
Red Hat	OpenShift Developer Tools and Services 4.22	—

References

Timeline

Published: Jun 10, 2026
Last modified: Oct 26, 2026
NVD status: Modified

Related CVEs from 2026

CVE-2026-534384.3A missing permission check in Jenkins 2.567 and earlier, LTS 2.555.2 and earlier allows attackers with Item/Cancel permission, but lacking I CVE-2026-534394.3Missing permission checks in Jenkins 2.567 and earlier, LTS 2.555.2 and earlier allow attackers with Overall/Read permission to determine ot CVE-2026-53446.3A security vulnerability has been detected in Textpattern up to 4.9.1. Affected by this vulnerability is the function mt_uploadImage of the CVE-2026-534404.3Jenkins 2.567 and earlier, LTS 2.555.2 and earlier does not ensure that the "from" parameter in the "Delegate to servlet container" security CVE-2026-534415.4Jenkins 2.483 through 2.567 (both inclusive), LTS 2.492.1 through 2.555.2 (both inclusive) does not escape the user-provided description of CVE-2026-534425.3Jenkins 2.567 and earlier, LTS 2.555.2 and earlier does not encrypt secrets from POST config.xml submissions before storing them in job conf CVE-2026-534447.6Wekan is open source kanban built with Meteor. Prior to 9.32, Wekan OIDC-related Meteor methods in packages/wekan-oidc/oidc_server.js, serve CVE-2026-534457.1Wekan is open source kanban built with Meteor. Prior to 9.32, the Wekan copyBoard Meteor DDP method in server/publications/boards.js copies CVE-2026-534466.2Wekan is open source kanban built with Meteor. Prior to 9.32, Wekan webhook integration URLs in models/integrations.js are stored from user CVE-2026-534476.5Wekan is open source kanban built with Meteor. Prior to 9.35, the Wekan cloneBoard Meteor method in models/import.js uses caller-supplied so CVE-2026-534487.2Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.12.0, the coturn HTTPS admin panel passes HTTP query paramet CVE-2026-534496.0Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.13.0, the psd print sessions dump CLI command in coturn take