CVE-2026-92141

Executive Summary

CVE-2026-92141 is an open redirect vulnerability (CWE-601) in the Jenkins Keycloak Authentication Plugin affecting versions 2.4.1 and earlier. The plugin fails to restrict the redirect URL after a successful login, allowing an attacker to craft a link that sends authenticated users to an attacker-controlled site for phishing. With a CVSS v3.1 base score of 4.3 (Medium) and requiring user interaction, the primary impact is credential harvesting and trust abuse rather than direct server compromise.

Technical Analysis

The vulnerability resides in the post-login redirect handling of the Jenkins Keycloak Authentication Plugin. Per the NVD description, the plugin "does not restrict the redirect URL after login," which is the canonical definition of CWE-601 (URL Redirection to Untrusted Site, commonly called "Open Redirect").

Mechanism at the vulnerability-class level: After the Keycloak authentication flow completes and the user is authenticated against Jenkins, the plugin issues an HTTP redirect to a destination value carried in the login request/response — typically via a parameter that holds the "return to" or "next" URL. Because the plugin does not validate or allow-list that destination against the Jenkins base URL, an attacker who controls the value can force the user's browser to a domain of the attacker's choosing immediately after login.

The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N is consistent with this class:

• AV:N — the malicious link is delivered over the network (e.g., email, chat, web).
• AC:L — no special conditions are needed to construct the link.
• PR:N — the attacker does not need authentication on the Jenkins instance to craft the URL.
• UI:R — the victim must click the link and complete the login flow for the redirect to occur.
• S:U — the impact is scoped to the browser/user context, not the Jenkins server.
• C:N / I:L / A:N — there is no read of server data or availability impact; the "Low" integrity impact reflects the diverted navigation and the fact that the browser is redirected away from the expected trust boundary.

The attack surface is the login endpoint that accepts the redirect target. Because the flow terminates the login and immediately issues a 3xx redirect, the vulnerable component is the post-authentication redirect issuance logic. No file paths, parameter names, or class names are specified in the NVD description or CNA title, so specific implementation identifiers are deliberately not asserted here. The affected artifact is the Jenkins Keycloak Authentication Plugin, distributed via the Jenkins update center, versions up to and including 2.4.1.

The security consequence is a failure of the trust boundary: the user believes they are interacting solely with the trusted Jenkins/Keycloak origin, but the authentication ceremony is used to lend credibility to a redirect to a hostile origin.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred strictly from the vulnerability class (CWE-601) and the NVD description. No function names, URL paths, or parameter names are asserted because none are provided in the source data.

1. Reconnaissance / target identification. The attacker identifies an internet- or intranet-accessible Jenkins instance that uses the Keycloak Authentication Plugin (versions <= 2.4.1). Targets can be found via search engines or internet scanners using the Shodan dorks above (e.g., sites exposing a Jenkins sign-in page). The attacker does not need an account on the instance.

2. Triggering the flaw class. The attacker crafts a URL to the Jenkins login endpoint that carries a redirect/return destination pointing at an attacker-controlled domain. This abuses the open-redirect behavior: because the plugin does not restrict the post-login redirect URL, the supplied destination is honored.

3. Payload / execution method. The attacker delivers the crafted link to the victim via phishing (email, chat, social engineering). When the victim clicks it, they are taken through the expected Keycloak login flow and authenticate to the legitimate Jenkins instance. On success, the plugin issues an HTTP redirect to the attacker-supplied URL instead of a safe internal Jenkins page, landing the victim on a look-alike page.

4. Post-exploitation impact. The attacker-controlled landing page can impersonate a Jenkins/Keycloak login prompt to harvest credentials, deliver a browser-based payload, or request OAuth/token consent. Because the redirect originates from the legitimate post-authentication flow, the victim's trust is elevated, increasing the likelihood of credential disclosure or session hijacking on the phishing page. The Jenkins server itself is not directly compromised by this CVE; the impact is client-side (C:N/I:L/A:N).

Impact Assessment

Business impact centers on credential theft and brand/trust abuse rather than server-side compromise. An open redirect that fires immediately after authentication is a high-fidelity phishing primitive: victims have just been validated by a trusted system and are more likely to trust the follow-on page. Security teams may observe user credential compromise on external pages, secondary account takeover where credentials are reused, and reputational damage from phishing links that begin on the organization's own Jenkins host.

Affected systems are Jenkins instances running the Keycloak Authentication Plugin version 2.4.1 and earlier. Blast radius is limited to users who interact with the crafted link and complete login (UI:R), but in large engineering organizations with many Jenkins users the reachable population is significant.

CVSS subscores: AV:N and AC:L make the exploit trivial to launch at scale; PR:N means no Jenkins account is required to weaponize the link; UI:R gates the attack on victim click-through; S:U, C:N, I:L, A:N keep the base score at 4.3 (Medium). There is no known exploit-in-the-wild and CISA KEV status is NO, so this is currently a lower-urgency but easy-to-chain issue, especially when combined with social engineering.

Detection Guidance

Sigma Rule

title: Potential Jenkins Keycloak Auth Plugin Open Redirect (CVE-2026-92141)
id: 8f1c2a54-6b3e-4a91-9d2f-cve202692141
status: experimental
description: Detects HTTP requests to a Jenkins Keycloak login endpoint carrying an external redirect destination parameter, indicative of CVE-2026-92141 open redirect abuse.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-92141
author: Valters IT Threat Intelligence
date: 2026/01/01
logsource:
  category: webserver
  product: generic
detection:
  selection_login:
    cs-uri-stem|contains:
      - '/securityRealm'
      - '/login'
  selection_redirect:
    cs-uri-query|contains:
      - 'redirect='
      - 'return_to='
      - 'from='
      - 'next='
  filter_external:
    cs-uri-query|re: '(?i)(redirect|return_to|from|next)=(https?://|%2f%2f)'
  condition: selection_login and selection_redirect and filter_external
falsepositives:
  - Legitimate SSO return flows using absolute URLs
  - Internal documentation referencing the login endpoint
level: medium
tags:
  - attack.t1566
  - cve.2026.92141

YARA Rule

rule CVE_2026_92141_Jenkins_Keycloak_OpenRedirect
{
    meta:
        description = "Detects references to the Jenkins Keycloak Authentication Plugin open redirect (CVE-2026-92141) in logs, tickets, or harvested artifacts"
        author = "Valters IT Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-92141"
        date = "2026-01-01"
        severity = "medium"
    strings:
        $cve = "CVE-2026-92141" ascii nocase
        $plugin = "keycloak" ascii nocase
        $jenkins = "jenkins" ascii nocase
        $redirect1 = "redirect_uri" ascii nocase
        $redirect2 = "return_to" ascii nocase
    condition:
        $cve or (2 of ($plugin, $jenkins, $redirect1, $redirect2))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-92141 Jenkins Keycloak Auth Plugin Open Redirect Attempt"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"login"; nocase; http.uri; pcre:"/(redirect|return_to|from|next)=(https?%3A%2F%2F|https?:\/\/|%2F%2F)/i"; reference:cve,2026-92141; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-92141; classtype:attempted-recon; sid:202692141; rev:1;)

Elastic Detection

sequence by source.ip, user.name with maxspan=10m
  [ network where network.protocol == "http" and url.path : "*login*" and
    url.query : ("*redirect=*" or "*return_to=*" or "*next=*") and
    url.query : ("*http://*" or "*https://*") and
    not url.domain : ("*jenkins*") ]
  [ network where network.protocol == "http" and
    http.response.status_code >= 300 and http.response.status_code <= 399 and
    response.headers.location : ("http://*" or "https://*") and
    not response.headers.location : ("*jenkins*") ]

Splunk SPL Query

index=web sourcetype=access_combined
| eval uri=urldecode(uri)
| where (like(uri, "%login%") OR like(uri, "%securityRealm%"))
| regex uri="(?i)(redirect|return_to|from|next)=(https?://|//|%2f%2f)"
| eval external=if(match(uri, "(?i)(redirect|return_to|from|next)=(https?://|//)(?!.*jenkins)"), 1, 0)
| where external=1
| stats count min(_time) as first_seen max(_time) as last_seen values(uri) as crafted_uris by src_ip, useragent
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="web,jenkins,cve-2026-92141,">
  <rule id="202692141" level="8">
    <if_sid>31100</if_sid>
    <id>^200$</id>
    <url>login|securityRealm</url>
    <regex type="pcre2">(?i)(redirect|return_to|from|next)=(https?://|//)(?!.*jenkins)</regex>
    <description>CVE-2026-92141: Possible Jenkins Keycloak Authentication Plugin open redirect - external redirect parameter detected</description>
    <mitre>
      <id>T1566</id>
    </mitre>
    <group>attack_attempt,phishing,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations

• Treat the plugin as vulnerable and restrict the redirect destination at the edge: if fronting Jenkins with a reverse proxy or WAF, add rules that reject login requests carrying redirect/return parameters whose value is an absolute external URL (require relative paths or an allow-listed set of destination hosts).
• Reduce exposure: do not expose the Jenkins/Keycloak login flow directly to the internet where avoidable; place it behind a VPN or identity-aware proxy.
• User-side controls: enable email security scanning to strip or flag phishing links pointing at internal Jenkins hosts, and run awareness training about post-login redirect phishing.
• Monitor access logs and proxy logs for requests with external redirect parameters against the login endpoint (see Detection Guidance).

2. Patch / upgrade steps

• No fixed version is identified in any tracked source at this time. Monitor the Jenkins security advisories and plugin update center for a Keycloak Authentication Plugin release that resolves CVE-2026-92141; upgrade immediately when available.
• If the plugin is not required, disabling/removing it eliminates the attack surface entirely.

3. Long-term hardening

• Apply an allow-list model for post-authentication redirects: only relative paths or explicitly trusted internal hosts should be accepted as redirect targets.
• Periodically audit installed Jenkins plugins against the Jenkins security advisory feed.
• Deploy phishing-resistant authentication (WebAuthn/FIDO2) to make harvested credentials less useful.
• Continuously track EPSS and CISA KEV status; re-score risk if exploitation activity emerges.

References

• NVD — CVE-2026-92141: https://nvd.nist.gov/vuln/detail/CVE-2026-92141
• CWE-601: URL Redirection to Untrusted Site (Open Redirect): https://cwe.mitre.org/data/definitions/601.html
• Jenkins Security Advisories: https://www.jenkins.io/security/advisories/
• Jenkins Keycloak Authentication Plugin: https://plugins.jenkins.io/keycloak-auth/
• MITRE ATT&CK T1566 — Phishing: https://attack.mitre.org/techniques/T1566/

Note on threat activity: No public PoC or exploit code is available, and no exploit-in-the-wild evidence or threat actor campaign is documented for this CVE. CISA KEV status is NO; EPSS has not yet been scored by FIRST.org. The exploitability of an open redirect is nonetheless high in practice because weaponization requires only a crafted URL and social engineering.