The Jenkins Microsoft Entra ID Plugin versions 666.v6060de32f87d and earlier allow unrestricted redirect URLs after user login, enabling attackers to redirect authenticated users to arbitrary URLs. This behavior can facilitate phishing attacks by misleading users to malicious destinations after successful authentication. The plugin is cloud-hosted, and the vendor manages remediation for this service. While no CVSS score is assigned, the vulnerability is recognized and a patch is available.

This vulnerability enables attackers to perform phishing attacks by exploiting the lack of redirect URL restrictions after login in the Jenkins Microsoft Entra ID Plugin. Users may be redirected to malicious websites, potentially leading to credential theft or other social engineering attacks. There are no reports of active exploitation in the wild.

Since this is a cloud-hosted service, the vendor manages remediation and typically applies patches server-side. A patch is available for this vulnerability. Users and administrators should verify with the Jenkins Project advisory that their environment is updated to a patched version to prevent exploitation. No additional action is required if the service is managed by the vendor and confirmed patched.