Medium severity4.3NVD Advisory· Published Apr 29, 2026· Updated May 5, 2026

CVE-2026-42525

Description

Jenkins Microsoft Entra ID (previously Azure AD) Plugin 666.v6060de32f87d and earlier does not restrict the redirect URL after login, allowing attackers to perform phishing attacks.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
org.jenkins-ci.plugins:azure-adMaven	< 667.v4c5827a	667.v4c5827a

Affected products

Jenkins/Azure Ad
cpe:2.3:a:jenkins:azure_ad:*:*:*:*:*:jenkins:*:*
Range: <=666.v6060de32f87d

Patches

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

github.com/advisories/GHSA-jp6g-g3v3-6gvfghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2026-42525ghsaADVISORY
www.jenkins.io/security/advisory/2026-04-29/nvdVendor AdvisoryWEB

News mentions

No linked articles in our index yet.

cvss	0.280
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000