The vulnerability causes Jenkins to incorrectly accept a redirect URL after login that contains tab or newline characters between the double slashes, treating it as a legitimate Jenkins URL. This allows an attacker to trick users into following a crafted redirect that points to an external malicious site, facilitating credential phishing. The flaw results from insufficient input validation of the redirect parameter, allowing an Open Redirect type exploit.

Jenkins core versions 2.567 and older and LTS releases up to 2.555.2 are affected. All installations using these versions inherit the redirect handling behavior that permits the improper URL pattern.

The CVSS score of 4.3 indicates moderate severity. The lack of an EPSS entry and absence from the KEV catalog suggest limited public exploitation data, but the flaw remains exploitable by anyone who can influence the redirect target for a logged‑in user. A credential‑stealing attack would require the user to be logged into Jenkins and to click the malicious link; thus, the risk is moderate to high in environments where external redirects are enabled.