CVE-2026-92141

CVE-2026-92141 is an open redirect flaw (CWE-601) in the Jenkins Keycloak Authentication Plugin version 2.4.1 and earlier, which fails to restrict the URL a user is redirected to after logging in. An attacker can craft a link that sends a victim through the Jenkins Keycloak login flow and then redirects them to an attacker-controlled site. Because the redirect follows a successful login, victims may perceive the destination page as legitimate, enabling convincing phishing attacks that harvest credentials or other sensitive information. Any Jenkins instance running the plugin at version 2.4.1 or earlier is affected. No public proof-of-concept is known, the issue is not listed in CISA KEV, and there are no confirmed reports of exploitation in the wild.

What to do: Upgrade the Keycloak Authentication Plugin to a release newer than 2.4.1 as directed by the Jenkins security advisory. Until patched, alert Jenkins users to verify the destination URL after logging in and be wary of phishing lures that link through Jenkins authentication pages. Administrators should audit plugin update centers and Jenkins controller logs for unexpected post-login redirects.