Jenkins versions 2.567 and earlier, including LTS 2.555.2, incorrectly treat redirect URLs that contain relative path segments such as ./ or ../ as legitimate after a user logs in. This flaw allows attackers to redirect a user’s browser to an arbitrary external site, thereby facilitating phishing attacks that can steal credentials. The weakness aligns with CWE-601, URL Redirection to Untrusted Resource.

The Jenkins Project’s Jenkins is affected. Vulnerable releases include all Jenkins 2.567 and older, and all Long‑Term Support releases 2.555.2 and older.

The EPSS score is not provided and the vulnerability is not listed in the CISA KEV catalog, indicating no known large‑scale exploitation yet. Attackers could exploit this by directing a legitimate user to a malicious site immediately after login, with no additional authentication required. The risk is moderate to high for environments where users log in through web interfaces, especially if credential reuse occurs. No official workaround is published.