Vulnerability in Jenkins Project Jenkins Keycloak Authentication Plugin

[ Why it matters ]Priority signals

• Interim mitigation published by PrivacySafe

[ Description ]Official description

Jenkins Keycloak Authentication Plugin 2.4.1 and earlier does not restrict the redirect URL after login, allowing attackers to perform phishing attacks.

[ Fixes ]Fixes and patches

• Jenkins plugins, advisory of 16 September 2026Interim mitigation · PrivacySafe · Read-only check for 13 Jenkins plugins including Script Security (eight High sandbox bypasses)

[ References ]References

• www.jenkins.io/security/advisory/2026-09-16vendor-advisory