CVE-2025-24399

High

Description

Jenkins OpenId Connect Authentication Plugin 4.452.v2849b_d3945fa_ and earlier, except 4.438.440.v3f5f201de5dc, treats usernames as case-insensitive, allowing attackers on Jenkins instances configured with a case-sensitive OpenID Connect provider to log in as any user by providing a username that differs only in letter case, potentially gaining administrator access to Jenkins.

SeverityHigh

CVSS8.8

Exploit probability—

Product

Jenkins Openid Connect Authentication

PublishedJan 22, 2025

First seenJan 22, 2025

Weakness typeCWE-276CWE-276

How to fix

Update

jenkins openid_connect_authentication4.438.440.v3f5f201de5dc, 4.453.v4d7765c854f4 or later
org.jenkins-ci.plugins:oic-auth4.453.v4d7765c854f4 or later

Vendor advisories

jenkins.io/security/advisory/2025-01-22/#SECURITY-3461

Affected products

Product	Affected versions	Fixed in
jenkins openid_connect_authentication	v < 4.438.440.v3f5f201de5dc, 4.444.vd4c54f157201 ≤ v < 4.453.v4d7765c854f4	4.438.440.v3f5f201de5dc, 4.453.v4d7765c854f4
org.jenkins-ci.plugins:oic-authMaven	v < 4.453.v4d7765c854f4	4.453.v4d7765c854f4

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.