CVE-2026-53437 affects Jenkins Project Jenkins versions 2.567 and earlier, including LTS 2.555.2 and earlier. The vulnerability arises because Jenkins improperly determines that a redirect URL after login legitimately points to Jenkins when the URL contains tab or newline characters between the '//' characters. This improper validation can be exploited by attackers to perform phishing attacks by redirecting users to malicious sites under the guise of legitimate Jenkins URLs. The CVSS v3.1 base score is 4.3, indicating a medium severity vulnerability with network attack vector, low complexity, no privileges required, user interaction required, unchanged scope, no confidentiality or availability impact, and low integrity impact. No official patch or remediation level is indicated in the available data. The Red Hat advisory linked does not provide explicit patch or mitigation details in the provided content.

The vulnerability enables attackers to craft malicious redirect URLs that appear to be legitimate Jenkins URLs due to improper URL validation involving tab or newline characters. This can facilitate phishing attacks targeting Jenkins users, potentially leading to user deception and credential theft. There is no direct impact on confidentiality, availability, or system integrity beyond the phishing risk as per the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is indicated in the provided data, users should monitor the Jenkins project and Red Hat advisories for updates. Until a fix is available, users should be cautious with redirect URLs after login and educate users about phishing risks involving URL obfuscation with whitespace characters.