The Jenkins Keycloak Authentication Plugin up to version 2.4.1 does not properly restrict the redirect URL following user login. This lack of validation enables attackers to craft malicious redirect URLs that can be used in phishing attacks to deceive users into visiting harmful websites after authenticating through Jenkins.

Attackers can exploit this vulnerability to redirect authenticated users to arbitrary URLs, potentially leading to phishing attacks. This can result in users being tricked into revealing sensitive information or credentials on malicious sites. There is no indication of direct code execution or privilege escalation from this vulnerability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should be cautious about redirect URLs used after login and consider implementing additional validation or monitoring for suspicious redirects.