CVE-2021-21671 Jenkins 2.299 and earlier, LTS 2.289.1 and earlier does not invalidate the previous session on login

Description

Jenkins 2.299 and earlier, LTS 2.289.1 and earlier does not invalidate the previous session on login.

Affected products and versions

Product	Affected versions	Fixed in
Jenkins 2.299	earliest → 2.299	No fix stated
Jenkins 2.266	2.266 → latest	No fix stated

Other CVEs of Jenkins

The 153 CVEs of Jenkins →

CVE-2026-117626 Jenkins 2.587 and earlier, LTS 2.580.1 and earlier improperly identifies file paths attempting path traversal in the… 4.3 Medium CVE-2026-117625 A missing permission check in Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows attackers with Overall/Read… 4.3 Medium CVE-2026-117624 Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not consistently enforce the restriction on deserializing… 8.8 High CVE-2026-117623 Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not escape the text shown in the tooltips of breadcrumb bar… 5.4 Medium