Jenkins Openid Connect Authentication Plugin (Jenkins Project) - vulnerabilities (CVEs)
8 CVEs, 0 in the last 30 days, 2 known versions, newest CVE from 2025-01-22. Vendor: Jenkins Project.
CVEs of Jenkins Openid Connect Authentication Plugin
- CVE-2025-24399 - CVSS 8.8 (high), 2025-01-22: Jenkins OpenId Connect Authentication Plugin 4.452.v2849b_d3945fa_ and earlier, except 4.438.440.v3f5f201de5dc, treats usernames as case-insensitive, allowing…
- CVE-2024-52553 - CVSS 8.8 (high), 2024-11-13: Jenkins OpenId Connect Authentication Plugin 4.418.vccc7061f5b_6d and earlier does not invalidate the previous session on login.
- CVE-2024-47807 - CVSS 8.1 (high), 2024-10-02: Jenkins OpenId Connect Authentication Plugin 4.354.v321ce67a_1de8 and earlier does not check the `iss` (Issuer) claim of an ID Token, allowing attackers to…
- CVE-2024-47806 - CVSS 8.1 (high), 2024-10-02: Jenkins OpenId Connect Authentication Plugin 4.354.v321ce67a_1de8 and earlier does not check the `aud` (Audience) claim of an ID Token, allowing attackers to…
- CVE-2023-50771 - CVSS 6.1 (medium), 2023-12-13: Jenkins OpenId Connect Authentication Plugin 2.6 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins,…
- CVE-2023-50770 - CVSS 6.7 (medium), 2023-12-13: Jenkins OpenId Connect Authentication Plugin 2.6 and earlier stores a password of a local user account used as an anti-lockout feature in a recoverable…
- CVE-2023-24424 - CVSS 8.8 (high), 2023-01-26: Jenkins OpenId Connect Authentication Plugin 2.4 and earlier does not invalidate the previous session on login.
- CVE-2019-1003021 - CVSS 4.3 (medium), 2019-02-06: An exposure of sensitive information vulnerability exists in Jenkins OpenId Connect Authentication Plugin 1.4 and earlier in OicSecurityRealm/config.jelly…
