Jenkins OpenId Connect Authentication Plugin 4.452.v2849b_d3945fa_ and earlier, except 4.438.440.v3f5f201de5dc, treats usernames as case-insensitive, allowing attackers on Jenkins instances configured with a case-sensitive OpenID Connect provider to log in as any user by providing a username that differs only in letter case, potentially gaining administrator access to Jenkins.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Jenkins OpenId Connect Authentication Plugin 4.452.v2849b_d3945fa_ and earlier, except
    4.438.440.v3f5f201de5dc, treats usernames as case-insensitive, allowing attackers on Jenkins instances
    configured with a case-sensitive OpenID Connect provider to log in as any user by providing a username
    that differs only in letter case, potentially gaining administrator access to Jenkins. (CVE-2025-24399)

According to their self-reported version numbers, the version of Jenkins plugins running on the remote web server are affected by multiple vulnerabilities:

  - Jenkins OpenId Connect Authentication Plugin 4.452.v2849b_d3945fa_ and earlier, except     4.438.440.v3f5f201de5dc, treats usernames as case-insensitive, allowing attackers on Jenkins instances     configured with a case-sensitive OpenID Connect provider to log in as any user by providing a username     that differs only in letter case, potentially gaining administrator access to Jenkins. (CVE-2025-24399)

  - Jenkins Eiffel Broadcaster Plugin 2.8.0 through 2.10.2 (both inclusive) uses the credential ID as the     cache key during signing operations, allowing attackers able to create a credential with the same ID as a     legitimate one in a different credentials store to sign an event published to RabbitMQ with the legitimate     credentials. (CVE-2025-24400)

  - Jenkins Folder-based Authorization Strategy Plugin 217.vd5b_18537403e and earlier does not verify that     permissions configured to be granted are enabled, potentially allowing users formerly granted (typically     optional permissions, like Overall/Manage) to access functionality they're no longer entitled to.
    (CVE-2025-24401)

  - A cross-site request forgery (CSRF) vulnerability in Jenkins Azure Service Fabric Plugin 1.6 and earlier     allows attackers to connect to a Service Fabric URL using attacker-specified credentials IDs obtained     through another method. (CVE-2025-24402)

  - Cleartext storage of sensitive information in the Zoom Jenkins bot plugin before version 1.6 may allow an     authenticated user to conduct a disclosure of information via network access. Users can update to the     latest version at https://plugins.jenkins.io/zoom/releases/. (CVE-2025-0142)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
414270	SCA: security update for org.jenkins-ci.plugins:oic-auth (GHSA-q9cm-88jx-3vfw)	Tenable Cloud Security	SCA Checks	Local	high
414270	SCA: security update for org.jenkins-ci.plugins:oic-auth (GHSA-q9cm-88jx-3vfw)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
214537	Jenkins plugins Multiple Vulnerabilities (2025-01-22)	Nessus	CGI abuses	Combined	high

Detections

Analytics

CVE-2025-24399

high

Tenable Plugins

high

high

high