CVE-2026-53436 affects Jenkins by improperly determining the legitimacy of redirect URLs after user login when these URLs include relative path segments ('./' or '../'). This improper validation can be leveraged by attackers to perform phishing attacks by redirecting authenticated users to attacker-controlled sites that appear to be part of the Jenkins environment. The vulnerability impacts Jenkins versions up to and including 2.567 and LTS versions up to and including 2.555.2. No CVSS score or vendor advisory with patch information is currently available.

The vulnerability enables attackers to perform phishing attacks by redirecting users to malicious URLs that appear to be legitimate Jenkins pages due to improper URL validation. This can lead to credential theft or other social engineering attacks targeting Jenkins users. There is no indication of remote code execution or direct system compromise from this vulnerability alone.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution with redirect URLs after login and consider implementing additional monitoring or controls on URL redirection behavior if possible. Avoid clicking on suspicious links that may exploit this vulnerability.