Jenkins Project Jenkins Microsoft Entra ID (previously Azure AD) Plugin vulnerabilities

🔔 Create alert RSS Version checker

Published CVEs affecting Jenkins Project Jenkins Microsoft Entra ID (previously Azure AD) Plugin: 2 record(s), with affected versions and fixes.

CVE-2026-84672 High · 8.8 CWE-639 Sep 2, 2026

Authorization Bypass Through User-Controlled Key (IDOR) in Jenkins Project Jenkins Microsoft Entra ID (previously Azure AD) Plugin

Jenkins Microsoft Entra ID (previously Azure AD) Plugin 710.v0b_ff8e9cc2d2 and earlier grants Entra group permissions using both the group's unique object ID and its display name, allowing attackers who can create an Entra group with a colliding display name to gain the permissions configured for a privileged group.

CVE-2026-42525 Medium · 4.3 CWE-601 Apr 29, 2026

Jenkins Microsoft Entra ID (previously Azure AD) Plugin has an open redirect vulnerability

Jenkins Microsoft Entra ID (previously Azure AD) Plugin 666.v6060de32f87d and earlier does not restrict the redirect URL after login, allowing attackers to perform phishing attacks.