Jenkins versions 2.567 and earlier, including LTS 2.555.2 and earlier, do not properly validate the "from" parameter in the "Delegate to servlet container" security realm. This improper validation allows attackers to craft URLs that redirect users to malicious domains after login, facilitating phishing attacks. The vulnerability is identified as CWE-601 (Open Redirect). The CVSS v3.1 base score is 4.3, reflecting a network attack vector with low complexity, no privileges required, user interaction needed, and limited impact on integrity only. There is no vendor advisory or patch available at this time, and no known exploits in the wild have been reported.

The vulnerability enables attackers to perform phishing attacks by redirecting authenticated users to attacker-controlled domains after login. This can lead to user deception and potential credential theft or further social engineering. There is no direct impact on confidentiality or availability reported. The medium CVSS score reflects the limited scope of impact restricted to integrity via phishing redirection.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should be cautious of unexpected redirects after login when using the "Delegate to servlet container" security realm. Consider implementing additional monitoring or user education to mitigate phishing risks related to this vulnerability.