{
  "threat_severity" : "Important",
  "public_date" : "2026-06-10T13:05:58Z",
  "bugzilla" : {
    "description" : "jenkins: Jenkins: Phishing attack via improper redirect URL validation",
    "id" : "2487544",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2487544"
  },
  "cvss3" : {
    "cvss3_base_score" : "7.4",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N",
    "status" : "verified"
  },
  "cwe" : "CWE-601",
  "details" : [ "Jenkins 2.567 and earlier, LTS 2.555.2 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins when it contains tab or newline characters between `//`, allowing attackers to perform phishing attacks.", "A flaw was found in Jenkins. This vulnerability allows a remote attacker to perform phishing attacks by crafting a malicious redirect URL. The flaw occurs because Jenkins improperly validates redirect URLs after login, specifically when tab or newline characters are present between the `//` in the URL. This can trick users into visiting malicious sites, potentially leading to credential theft or other security compromises." ],
  "statement" : "This is an Important vulnerability in Jenkins that allows remote attackers to conduct phishing attacks. The flaw stems from improper validation of redirect URLs after login, specifically when tab or newline characters are present, which can be exploited to redirect users to malicious sites. This could lead to credential theft and other security compromises for users interacting with affected Jenkins instances in Red Hat OpenShift Developer Tools & Services.",
  "affected_release" : [ {
    "product_name" : "OpenShift Developer Tools and Services 4.12",
    "release_date" : "2026-08-26T00:00:00Z",
    "advisory" : "RHSA-2026:60247",
    "cpe" : "cpe:/a:redhat:ocp_tools:4.12::el8",
    "package" : "ocp-tools-4/jenkins-rhel8:1786628667"
  }, {
    "product_name" : "OpenShift Developer Tools and Services 4.13",
    "release_date" : "2026-08-26T00:00:00Z",
    "advisory" : "RHSA-2026:60249",
    "cpe" : "cpe:/a:redhat:ocp_tools:4.13::el8",
    "package" : "ocp-tools-4/jenkins-rhel8:1786628681"
  }, {
    "product_name" : "OpenShift Developer Tools and Services 4.14",
    "release_date" : "2026-08-26T00:00:00Z",
    "advisory" : "RHSA-2026:60248",
    "cpe" : "cpe:/a:redhat:ocp_tools:4.14::el8",
    "package" : "ocp-tools-4/jenkins-rhel8:1786533561"
  }, {
    "product_name" : "OpenShift Developer Tools and Services 4.15",
    "release_date" : "2026-08-26T00:00:00Z",
    "advisory" : "RHSA-2026:60239",
    "cpe" : "cpe:/a:redhat:ocp_tools:4.15::el8",
    "package" : "ocp-tools-4/jenkins-rhel8:1786533565"
  }, {
    "product_name" : "OpenShift Developer Tools and Services 4.16",
    "release_date" : "2026-08-26T00:00:00Z",
    "advisory" : "RHSA-2026:60251",
    "cpe" : "cpe:/a:redhat:ocp_tools:4.16::el9",
    "package" : "ocp-tools-4/jenkins-rhel9:1787125166"
  }, {
    "product_name" : "OpenShift Developer Tools and Services 4.17",
    "release_date" : "2026-08-26T00:00:00Z",
    "advisory" : "RHSA-2026:60246",
    "cpe" : "cpe:/a:redhat:ocp_tools:4.17::el9",
    "package" : "ocp-tools-4/jenkins-rhel9:1787124635"
  }, {
    "product_name" : "OpenShift Developer Tools and Services 4.18",
    "release_date" : "2026-08-26T00:00:00Z",
    "advisory" : "RHSA-2026:60250",
    "cpe" : "cpe:/a:redhat:ocp_tools:4.18::el9",
    "package" : "ocp-tools-4/jenkins-rhel9:1787125069"
  }, {
    "product_name" : "OpenShift Developer Tools and Services 4.19",
    "release_date" : "2026-08-26T00:00:00Z",
    "advisory" : "RHSA-2026:60252",
    "cpe" : "cpe:/a:redhat:ocp_tools:4.19::el9",
    "package" : "ocp-tools-4/jenkins-rhel9:1787124632"
  }, {
    "product_name" : "OpenShift Developer Tools and Services 4.20",
    "release_date" : "2026-08-26T00:00:00Z",
    "advisory" : "RHSA-2026:60259",
    "cpe" : "cpe:/a:redhat:ocp_tools:4.20::el9",
    "package" : "ocp-tools-4/jenkins-rhel9:1787124925"
  }, {
    "product_name" : "OpenShift Developer Tools and Services 4.21",
    "release_date" : "2026-08-26T00:00:00Z",
    "advisory" : "RHSA-2026:60254",
    "cpe" : "cpe:/a:redhat:ocp_tools:4.21::el9",
    "package" : "ocp-tools-4/jenkins-rhel9:1787125311"
  }, {
    "product_name" : "OpenShift Developer Tools and Services 4.22",
    "release_date" : "2026-08-26T00:00:00Z",
    "advisory" : "RHSA-2026:60256",
    "cpe" : "cpe:/a:redhat:ocp_tools:4.22::el9",
    "package" : "ocp-tools-4/jenkins-rhel9:1787124779"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2026-53437\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-53437\nhttps://www.jenkins.io/security/advisory/2026-06-10/#SECURITY-3711+3755" ],
  "name" : "CVE-2026-53437",
  "mitigation" : {
    "value" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
    "lang" : "en:us"
  },
  "csaw" : false
}