CVE-2026-53437

MediumCVSS 4.3/10Last modified Oct 26, 2026

Description

Jenkins 2.567 and earlier, LTS 2.555.2 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins when it contains tab or newline characters between `//`, allowing attackers to perform phishing attacks.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-601

Affected software

VendorProductVersions
Jenkins ProjectJenkins—
Red HatOpenShift Developer Tools and Services 4.12—
Red HatOpenShift Developer Tools and Services 4.13—
Red HatOpenShift Developer Tools and Services 4.14—
Red HatOpenShift Developer Tools and Services 4.15—
Red HatOpenShift Developer Tools and Services 4.16—
Red HatOpenShift Developer Tools and Services 4.17—
Red HatOpenShift Developer Tools and Services 4.18—
Red HatOpenShift Developer Tools and Services 4.19—
Red HatOpenShift Developer Tools and Services 4.20—
Red HatOpenShift Developer Tools and Services 4.21—
Red HatOpenShift Developer Tools and Services 4.22—

References

Timeline

Published
Jun 10, 2026
Last modified
Oct 26, 2026
NVD status
Modified

Related CVEs from 2026

CVE-2026-534384.3A missing permission check in Jenkins 2.567 and earlier, LTS 2.555.2 and earlier allows attackers with Item/Cancel permission, but lacking ICVE-2026-534394.3Missing permission checks in Jenkins 2.567 and earlier, LTS 2.555.2 and earlier allow attackers with Overall/Read permission to determine otCVE-2026-53446.3A security vulnerability has been detected in Textpattern up to 4.9.1. Affected by this vulnerability is the function mt_uploadImage of the CVE-2026-534404.3Jenkins 2.567 and earlier, LTS 2.555.2 and earlier does not ensure that the "from" parameter in the "Delegate to servlet container" securityCVE-2026-534415.4Jenkins 2.483 through 2.567 (both inclusive), LTS 2.492.1 through 2.555.2 (both inclusive) does not escape the user-provided description of CVE-2026-534425.3Jenkins 2.567 and earlier, LTS 2.555.2 and earlier does not encrypt secrets from POST config.xml submissions before storing them in job confCVE-2026-534447.6Wekan is open source kanban built with Meteor. Prior to 9.32, Wekan OIDC-related Meteor methods in packages/wekan-oidc/oidc_server.js, serveCVE-2026-534457.1Wekan is open source kanban built with Meteor. Prior to 9.32, the Wekan copyBoard Meteor DDP method in server/publications/boards.js copies CVE-2026-534466.2Wekan is open source kanban built with Meteor. Prior to 9.32, Wekan webhook integration URLs in models/integrations.js are stored from user CVE-2026-534476.5Wekan is open source kanban built with Meteor. Prior to 9.35, the Wekan cloneBoard Meteor method in models/import.js uses caller-supplied soCVE-2026-534487.2Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.12.0, the coturn HTTPS admin panel passes HTTP query parametCVE-2026-534496.0Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.13.0, the psd print sessions dump CLI command in coturn take