CVE-2026-53436 affects Jenkins versions up to 2.567 and LTS versions up to 2.555.2. The vulnerability arises because Jenkins improperly determines the legitimacy of redirect URLs after user login when those URLs contain relative path segments ('./' or '../'). This improper validation can be leveraged by attackers to perform phishing attacks by redirecting users to malicious external sites under the guise of Jenkins URLs. The vulnerability is categorized under CWE-601 (Open Redirect). The CVSS score of 4.3 reflects a medium severity with network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality impact, limited integrity impact, and no availability impact. There is no vendor advisory or patch information available at this time, and the vulnerability is not related to a cloud service.

The vulnerability allows attackers to craft URLs that redirect users after login to potentially malicious sites, facilitating phishing attacks. There is no direct impact on confidentiality or availability, but the integrity of user navigation can be compromised, potentially leading to credential theft or social engineering attacks. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should be cautious with login redirect URLs and consider implementing additional monitoring or user education to mitigate phishing risks. No official remediation or temporary fix is currently documented.