Junglewise Threat Intelligence

CVE-2026-53437: Jenkins open redirect via tab or newline characters in login URL

CVE-2026-53437 · Severity: medium · CVSS 4.3 · Published 2026-06-10

Technologies: Jenkins. Vendors: Jenkins.

Executive brief

Jenkins is an automation server widely used for continuous integration and deployment. This vulnerability allows attackers to bypass URL validation during login and redirect users to malicious websites, enabling phishing attacks to steal credentials. An attacker can craft a specially formatted redirect URL with hidden tab or newline characters that bypasses security checks, tricking users into visiting attacker-controlled domains.

Technical details

This is a URL redirection to untrusted site (open redirect) vulnerability (CWE-601) in Jenkins' login redirect validation logic. The vulnerable component is the post-login redirect handler, which checks whether a redirect URL is safe by validating that it does not contain a scheme (http://, https://, etc.) or start with //. However, the validation fails to strip tab (\t) and newline (\n) characters before performing this check. An attacker can insert a tab or newline character between // (e.g., "/\t/attacker.com"), which passes the validation check but is normalized by the browser to a scheme-relative URL pointing to attacker.com. The attack requires user interaction (clicking a login link with a crafted redirect parameter) but no prior authentication. Jenkins 2.568 and LTS 2.555.3 fix this by stripping tab and newline characters before validation and rejecting URLs containing // anywhere in the string.

Affected products

  • Jenkins Jenkins < 2.555.3 and >= 2.556, < 2.568

Timeline

  • 2026-06-10: disclosed
  • 2026-06-10: patched: Jenkins 2.568 and LTS 2.555.3 released

References

Related threats