{"id":"CVE-2026-42525","details":"Jenkins Microsoft Entra ID (previously Azure AD) Plugin 666.v6060de32f87d and earlier does not restrict the redirect URL after login, allowing attackers to perform phishing attacks.","aliases":["GHSA-jp6g-g3v3-6gvf"],"modified":"2026-07-15T06:09:58.902659Z","published":"2026-04-29T14:16:19.557Z","references":[{"type":"ADVISORY","url":"https://www.jenkins.io/security/advisory/2026-04-29/#SECURITY-3760"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/jenkinsci/azure-ad-plugin","events":[{"introduced":"0"},{"last_affected":"6060de32f87d0886327ca85c951e2357c19012ea"}],"database_specific":{"cpe":"cpe:2.3:a:jenkins:azure_ad:*:*:*:*:*:jenkins:*:*","extracted_events":[{"introduced":"0"},{"last_affected":"666.v6060de32f87d"}],"source":"CPE_RANGE"}}],"versions":["666.v6060de32f87d","631.vb_2d4d8cc86b_0","619.v53317a_30e630","603.ve543a_9f77895","602.v3fc9b_b_20d5a_8","601.v1fc8eb_fc8904","580.v2f665882b_a_71","561.v85263ce9a_b_b_f","560.vddeb_1142d399","552.va_63b_3140c917","551.v26fb_2998b_61f","531.v13107da_f2635","530.v161b_33ec6435","507.vea_a_a_167b_d05c","505.v747b_3185206a_","504.vc4785930e17a_","502.v7e7931d0665e","501.v1a_a_df23f81cb_","484.v5fd019a_39b_18","476.vd1c42682ea_6a_","471.vdfa_2441c67a_f","457.vf85d61f83b_26","449.v92b_39a_d8e523","448.v7b_29ca_541989","442.v355cca_6b_c169","433.v1982e2b_b_4a_fe","412.vdf45b_6a_b_da_81","411.va_da_65d0f7050","404.v99a_327a_b_8904","403.v725537911b_7e","401.vdec46839d6b_8","396.v86ce29279947","378.vd6e2874a_69eb_","393.v03d1cfd50759","392.v4e15d33fe85d","391.v252da_e1dd39c","385.v5d9f88612dd2","349.vc02b_a_0b_142a_8","348.vefd011eea_20b_","345.vdb_07735a_767d","340.vdef002cf6415","336.vd05b_01358644","313.v14b_f37ff114d","308.v10a_6e24f30b_4","306.va_7083923fd50","303.va_91ef20ee49f","267.v5b_dfb_514d9fd","241.vb_e5cd7c35b_2e","234.vb_ece34ecd5ff","233.v934e074916c7","218.v90f6a_980b_a_61","213.v5b_00db_295f49","195.v8555a0bf0d22","194.v70a6d5203ce4","191.vfc8019068670","189.v2da14dccdb43","188.v2369adb95a31","185.v3b416408dcb1","184.v44f04b65bdd5","183.vf8c6fa4c6567","180.v8b1e80e6f242","179.vf6841393099e","178.v7b93892fbe4c","177.v80b6c1591bf9","175.v5513346d764a","174.vc2d906355813","173.v0a210fffb510","172.vf6a517c3329a","171.v9ef20c94d336","170.v0a6219442a99","168.ve6e7e368dbf6","167.v34c2c5a3a030","165.v36344b7d7ca7","164.v5b48baa961d2","158.v437429002c6b","157.v2d3d5782a602","155.v745ce80af7ea","154.v12e17a5f9ea3","153.v7af57b288088","152.v1609ed460604","150.vb3db9f880321","146.vb688d1511c38","azure-ad-1.2.3","azure-ad-1.2.2","azure-ad-1.2.1","azure-ad-1.2.0","azure-ad-1.1.2","azure-ad-1.1.1","azure-ad-1.1.0","azure-ad-1.0.0","azure-ad-0.3.4","azure-ad-0.3.3","azure-ad-0.3.2","azure-ad-0.3.1","azure-ad-0.3.0","azure-ad-0.2.0","azure-ad-0.1.1-1","azure-ad-0.1.1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-42525.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"}]}