Description
Jenkins OpenId Connect Authentication Plugin 4.452.v2849b_d3945fa_ and earlier, except 4.438.440.v3f5f201de5dc, treats usernames as case-insensitive, allowing attackers on Jenkins instances configured with a case-sensitive OpenID Connect provider to log in as any user by providing a username that differs only in letter case, potentially gaining administrator access to Jenkins.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Jenkins Project | Jenkins OpenId Connect Authentication Plugin | — | 4.438.440.v3f5f201de5dc |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.jenkins-ci.plugins:oic-auth | < 4.453.v4d7765c854f4 | 4.453.v4d7765c854f4 | GHSA-q9cm-88jx-3vfw |
Advisories 1
- WID-SEC-2025-0175 Jenkins Plugins: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 22, 2025
References
- Jenkins Security Advisory 2025-01-22 vendor-advisory