CVE-2021-21673: Jenkins Cas

Medium severity, CVSS 6.1. EPSS: 1.6% chance of exploitation in the next 30 days.

Jenkins CAS Plugin 1.6.0 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins, allowing attackers to perform phishing attacks.

Affected products

• Jenkins Cas: up to and including 1.6.0

Published 2021-06-30. Last modified 2026-06-17.