CVE-2018-1000174: An open redirect vulnerability exists in Jenkins Google Login Plugin 1.3 and older in GoogleOAuth2SecurityR...

Security readout for executives and security teams

Jenkins Google Login Plugin 1.3 and older could send a user to an attacker-chosen website after they successfully logged in. This is mainly a phishing and trust-abuse risk around the login flow, not evidence of direct server compromise from the provided sources. Exposure is likely limited to Jenkins instances that use Google Login Plugin version 1.3 or older. Systems without this plugin, or using versions outside the stated affected range, are not identified as affected by the provided sources. Treat this as a moderate login-trust issue. It is unlikely to justify emergency response without exposure, but internet-facing or broadly used Jenkins instances should be checked and remediated promptly. Mitigation focus: Inventory Jenkins instances using Google Login Plugin.; Check installed plugin versions for 1.3 or older.; Review the Jenkins advisory for the vendor-supported fix or mitigation..

Prepared

Jun 7, 2026, 13:40 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.