Technical impact
The Jenkins Microsoft Entra ID (formerly Azure AD) Plugin up to version 666.v6060de32f87d allows an attacker to redirect users to arbitrary URLs after authentication. This flaw enables the construction of convincing phishing pages that can harvest user credentials or implant malware, potentially compromising any Jenkins environment that relies on this plugin for identity integration. The weakness stems from an lack of validation on redirect URLs, which is a classic web‑application vulnerability that grants attackers control over post‑login flow.
Affected Systems
The issue affects Jenkins installations using the Microsoft Entra ID Plugin, specifically all releases 666.v6060de32f87d and earlier. Any Jenkins instance that employs this plugin for Single Sign‑On with Microsoft Entra ID is vulnerable, regardless of the Jenkins core version.
Risk and Exploitability
Although no EPSS score or KEV listing is available, the CVSS score of 4.3 indicates low overall severity, yet the deficiency permits attackers to bypass normal authentication redirects and trick users into submitting credentials to malicious sites. The risk is high in environments where external networks or untrusted users can interact with the Jenkins login page. The exploit path is straightforward: after a user logs in through the plugin, the attacker can manipulate the redirect parameter to point to a phishing domain.
Github GHSA