Vulnerability · Published May 14, 2025 · Assigned by jenkins

CVE-2025-47884

Critical 9.1

In plain English

A critical-severity improper access control in Jenkins OpenID Connect Provider Plugin from Jenkins Project. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 51% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)9.1Critical

Exploit odds (30 days)0.6%top 49.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

In Jenkins OpenID Connect Provider Plugin 96.vee8ed882ec4d and earlier the generation of build ID Tokens uses potentially overridden values of environment variables, in conjunction with certain other plugins allowing attackers able to configure jobs to craft a build ID Token that impersonates a trusted job, potentially gaining unauthorized access to external services.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Maven	io.jenkins.plugins:oidc-provider	111.v29fd614b_3617	GHSA-q7c3-x7hm-qq72

Affected products (as reported)

Vendor	Product	Versions
Jenkins Project	Jenkins OpenID Connect Provider Plugin	0 – through 96.vee8ed882ec4d

Weakness: CWE-284 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:L

References

Jenkins Security Advisory 2025-05-14 vendor-advisory