CVE-2025-24399 Details
Description
Jenkins OpenId Connect Authentication Plugin 4.452.v2849b_d3945fa_ and earlier, except 4.438.440.v3f5f201de5dc, treats usernames as case-insensitive, allowing attackers on Jenkins instances configured with a case-sensitive OpenID Connect provider to log in as any user by providing a username that differs only in letter case, potentially gaining administrator access to Jenkins.
A vulnerability exists in the Jenkins OpenId Connect Authentication Plugin in versions through 4.452.v2849b_d3945fa_ and earlier, except for 4.438.440.v3f5f201de5dc. The plugin incorrectly handles username case sensitivity, treating usernames as case-insensitive. This flaw allows attackers on Jenkins instances with a case-sensitive OpenID Connect provider to log in as any user by using a username that varies only in case. Exploitation of this vulnerability could lead to unauthorized administrative access on Jenkins.
Users of the OpenId Connect Authentication Plugin should update to version 4.453.v4d7765c854f4. After upgrading, it is important to explicitly configure the plugin settings to enable case sensitivity, as the default behavior remains case-insensitive.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jan 23, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://www.jenkins.io/security/advisory/2025-01-22/#SECURITY-3461 | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-276 | Incorrect Default Permissions | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| jenkins openid connect authentication | < 4.438.440.v3f5f201de5dc >= 4.444.vd4c54f157201, < 4.453.v4d7765c854f4 |
CPE
Remediation
| |
Change History
7 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 17, 2026 | CVE Modified | [email protected] |
| May 7, 2025 | Initial Analysis | [email protected] |
| Mar 18, 2025 | CVE Modified | CISA-ADP |
| Feb 18, 2025 | CVE Modified | CISA-ADP |
| Jan 23, 2025 | CVE Modified | CISA-ADP |
| Jan 22, 2025 | New CVE Received | [email protected] |