VYPR
← All advisories
Moderate severityNVD Advisory· Published Dec 13, 2023· Updated Feb 13, 2025

CVE-2023-50771

CVE-2023-50771

Description

Jenkins OpenId Connect Authentication Plugin 2.6 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins, allowing attackers to perform phishing attacks.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Jenkins OpenId Connect Authentication Plugin 2.6 and earlier allows phishing by not validating redirect URLs after login.

Vulnerability

Description Jenkins OpenId Connect Authentication Plugin 2.6 and earlier does not properly validate that a redirect URL after login is legitimately pointing to Jenkins. This flaw allows an attacker to craft a redirect to a malicious site, enabling phishing attacks [1][4].

Exploitation

An attacker can trick a user into clicking a specially crafted login link. After successful authentication via OpenId Connect, the plugin redirects the user to the attacker-controlled URL instead of the legitimate Jenkins instance. No special privileges are required beyond the ability to craft such a link [1][3].

Impact

Successful exploitation can lead to credential theft or session hijacking, as users may enter sensitive information on the phishing page. The attack does not compromise the Jenkins instance itself but targets user credentials [3][4].

Mitigation

As of the Jenkins Security Advisory 2023-12-13, no fix is available for this plugin. Users are advised to monitor for updates or consider disabling the plugin if not essential [1][3].

References
  1. Jenkins Security Advisory 2023-12-13
  2. security - Multiple vulnerabilities in Jenkins plugins
  3. NVD - CVE-2023-50771

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
org.jenkins-ci.plugins:oic-authMaven
< 3.03.0

Affected products

2

Patches

1
a97a4041f39c

Add test for redirect url validation

https://github.com/jenkinsci/oic-auth-pluginBenjamin WenzelJan 31, 2024via ghsa
commit
2 files changed · +17 −1
  • src/main/java/org/jenkinsci/plugins/oic/OicSecurityRealm.java+1 −1 modified
    @@ -730,7 +730,7 @@ protected AuthorizationCodeFlow buildAuthorizationCodeFlow() {
         return builder.build();
     }
 
-    private String getValidRedirectUrl(String url) {
+    protected String getValidRedirectUrl(String url) {
         if (url != null && !url.isEmpty()) {
             // Check if the URL is relative and starts with a slash
             if (url.startsWith("/")) {
  • src/test/java/org/jenkinsci/plugins/oic/OicSecurityRealmTest.java+16 −0 modified
    @@ -4,6 +4,8 @@
 import com.github.tomakehurst.wiremock.junit.WireMockRule;
 import hudson.util.Secret;
 import java.io.IOException;
+import java.net.MalformedURLException;
+
 import org.acegisecurity.AuthenticationManager;
 import org.acegisecurity.BadCredentialsException;
 import org.acegisecurity.GrantedAuthority;
@@ -16,6 +18,7 @@
 
 import static org.junit.Assert.assertEquals;
 import static org.junit.Assert.assertNotNull;
+import static org.junit.Assert.assertThrows;
 
 public class OicSecurityRealmTest {
 
@@ -83,4 +86,17 @@ public void testShouldSetNullClientSecretWhenSecretIsNone() throws IOException {
             .build();
         assertEquals("none", Secret.toString(realm.getClientSecret()));
     }
+
+    @Test
+    public void testGetValidRedirectUrl() throws IOException {
+        String rootUrl = "http://localhost:" + wireMockRule.port() + "/jenkins/";
+
+        TestRealm realm = new TestRealm.Builder(wireMockRule)
+                .WithMinimalDefaults().build();
+        assertEquals(rootUrl + "foo", realm.getValidRedirectUrl("/foo"));
+        assertEquals(rootUrl + "bar", realm.getValidRedirectUrl(rootUrl + "bar"));
+        assertEquals(rootUrl, realm.getValidRedirectUrl(null));
+        assertEquals(rootUrl, realm.getValidRedirectUrl(""));
+        assertThrows(MalformedURLException.class, () -> realm.getValidRedirectUrl("foobar"));
+    }
 }

Vulnerability mechanics

Generated on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

8

News mentions

1