PT-2026-35919 · Jenkins · Entra Id Plugin+1

Dyingman1 · Published 2026-04-29 · Updated 2026-05-05 · CVE-2026-42525

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Microsoft Entra ID (previously Azure AD) Plugin versions prior to 666.v6060de32f87d

Description The plugin does not restrict the redirect URL after login, which allows attackers to perform phishing attacks.

Recommendations Update the plugin to a version later than 666.v6060de32f87d.

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2026-42525

GHSA-JP6G-G3V3-6GVF

Affected Products

Jenkins

Entra Id Plugin

References · 7

• https://jenkins.io/security/advisory/2026-04-29/#SECURITY-3760 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-jp6g-g3v3-6gvf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-42525 · Security Note
• https://github.com/jenkinsci/azure-ad-plugin · Note
• https://twitter.com/CVEnew/status/2049578411056914777 · Twitter Post
• https://t.me/cveNotify/162189 · Telegram Post
• https://twitter.com/infoflowcloud/status/2049579835953918177 · Twitter Post