description: Jenkins OpenId Connect Authentication Plugin 2.6 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins, allowing attackers to perform phishing attacks.
affected:
{
vendor: Jenkins Project
product: Jenkins OpenId Connect Authentication Plugin
versions:
version: 0, versionType: maven, lessThanOrEqual: 2.6, status: affected
defaultStatus: unknown
}