GHSA-jp6g-g3v3-6gvf

Suggest an improvement
Source
https://github.com/advisories/GHSA-jp6g-g3v3-6gvf
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-jp6g-g3v3-6gvf/GHSA-jp6g-g3v3-6gvf.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-jp6g-g3v3-6gvf
Aliases
Published
2026-04-29T15:30:39Z
Modified
2026-05-06T23:11:24Z
Severity
  • 4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N CVSS Calculator
Summary
Jenkins Microsoft Entra ID (previously Azure AD) Plugin has an open redirect vulnerability
Details

Jenkins Microsoft Entra ID (previously Azure AD) Plugin versions 666.v6060de32f87d and earlier do not restrict the redirect URL after login.

This allows attackers to perform phishing attacks by having users go to a Jenkins URL that will forward them to a different site after successful authentication.

Microsoft Entra ID (previously Azure AD) Plugin 667.v4c5827a_e74a_0 only redirects to relative (Jenkins) URLs.

Database specific 
{
    "cwe_ids":  [
        "CWE-601"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-05-06T22:56:44Z",
    "nvd_published_at":  "2026-04-29T14:16:19Z",
    "severity":  "MODERATE"
}
References

Affected packages

Maven / org.jenkins-ci.plugins:azure-ad

Package

Name
org.jenkins-ci.plugins:azure-ad
View open source insights on deps.dev
Purl
pkg:maven/org.jenkins-ci.plugins/azure-ad

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
667.v4c5827a

Affected versions

0.*
0.1.1
0.1.1-1
0.2.0
0.3.0
0.3.1
0.3.2
0.3.3
0.3.4
1.*
1.0.0
1.1.0
1.1.1
1.1.2
1.2.0
1.2.1
1.2.2
1.2.3
146.*
146.vb688d1511c38
150.*
150.vb3db9f880321
152.*
152.v1609ed460604
153.*
153.v7af57b288088
154.*
154.v12e17a5f9ea3
155.*
155.v745ce80af7ea
157.*
157.v2d3d5782a602
158.*
158.v437429002c6b
164.*
164.v5b48baa961d2
165.*
165.v36344b7d7ca7
167.*
167.v34c2c5a3a030
168.*
168.ve6e7e368dbf6
170.*
170.v0a6219442a99
171.*
171.v9ef20c94d336
172.*
172.vf6a517c3329a
173.*
173.v0a210fffb510
174.*
174.vc2d906355813
175.*
175.v5513346d764a
177.*
177.v80b6c1591bf9
178.*
178.v7b93892fbe4c
179.*
179.vf6841393099e
180.*
180.v8b1e80e6f242
183.*
183.vf8c6fa4c6567
184.*
184.v44f04b65bdd5
185.*
185.v3b416408dcb1
188.*
188.v2369adb95a31
189.*
189.v2da14dccdb43
190.*
190.v872b1977148a
191.*
191.vfc8019068670
194.*
194.v70a6d5203ce4
195.*
195.v8555a0bf0d22
213.*
213.v5b_00db_295f49
218.*
218.v90f6a_980b_a_61
233.*
233.v934e074916c7
234.*
234.vb_ece34ecd5ff
241.*
241.vb_e5cd7c35b_2e
267.*
267.v5b_dfb_514d9fd
303.*
303.va_91ef20ee49f
306.*
306.va_7083923fd50
308.*
308.v10a_6e24f30b_4
313.*
313.v14b_f37ff114d
336.*
336.vd05b_01358644
340.*
340.vdef002cf6415
345.*
345.vdb_07735a_767d
348.*
348.vefd011eea_20b_
349.*
349.vc02b_a_0b_142a_8
378.*
378.vd6e2874a_69eb_
378.380.v545b_1154b_3fb_
385.*
385.v5d9f88612dd2
391.*
391.v252da_e1dd39c
392.*
392.v4e15d33fe85d
393.*
393.v03d1cfd50759
396.*
396.v86ce29279947
397.*
397.v907382dd9b_98
401.*
401.vdec46839d6b_8
403.*
403.v725537911b_7e
404.*
404.v99a_327a_b_8904
411.*
411.va_da_65d0f7050
412.*
412.vdf45b_6a_b_da_81
433.*
433.v1982e2b_b_4a_fe
442.*
442.v355cca_6b_c169
448.*
448.v7b_29ca_541989
449.*
449.v92b_39a_d8e523
457.*
457.vf85d61f83b_26
471.*
471.vdfa_2441c67a_f
476.*
476.vd1c42682ea_6a_
484.*
484.v5fd019a_39b_18
501.*
501.v1a_a_df23f81cb_
502.*
502.v7e7931d0665e
504.*
504.vc4785930e17a_
505.*
505.v747b_3185206a_
507.*
507.vea_a_a_167b_d05c
530.*
530.v161b_33ec6435
531.*
531.v13107da_f2635
551.*
551.v26fb_2998b_61f
552.*
552.va_63b_3140c917
560.*
560.vddeb_1142d399
561.*
561.v85263ce9a_b_b_f
580.*
580.v2f665882b_a_71
601.*
601.v1fc8eb_fc8904
602.*
602.v3fc9b_b_20d5a_8
603.*
603.ve543a_9f77895
618.*
618.v424da_973ffe8
619.*
619.v53317a_30e630
631.*
631.vb_2d4d8cc86b_0
666.*
666.v6060de32f87d

Database specific

last_known_affected_version_range 
"<= 666.v6060de32f87d"
source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-jp6g-g3v3-6gvf/GHSA-jp6g-g3v3-6gvf.json"