Skip to content
OpenAdvisories
High · 8.8 CVE-2023-24424 EUVD-2023-0566GHSA-vxmh-p52j-h33m

Session fixation vulnerability in Jenkins OpenId Connect Authentication Plugin

Published Jan 24, 2023 · Updated Apr 2, 2025 · Assigned by jenkins

Vendor: Jenkins Project Product: Jenkins OpenId Connect Authentication Plugin Package: org.jenkins-ci.plugins:oic-auth Category: Web / CMS Ecosystem: Maven

Description

Jenkins OpenId Connect Authentication Plugin 2.4 and earlier does not invalidate the previous session on login.

Affected products

VendorProductAffectedFixed
Jenkins Project Jenkins OpenId Connect Authentication Plugin unspecified – ≤ 2.4 —

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.jenkins-ci.plugins:oic-auth < 2.5 2.5 GHSA-vxmh-p52j-h33m

Advisories 1

References