CVE-2025-24399

Jenkins OpenId Connect Authentication Plugin 4.452.v2849b_d3945fa_ and earlier, except 4.438.440.v3f5f201de5dc, treats usernames as case-insensitive, allowing attackers on Jenkins instances configured with a case-sensitive OpenID Connect provider to log in as any user by providing a username that differs only in letter case, potentially gaining administrator access to Jenkins.

Published: Jan 22, 2025
Updated: Jun 30, 2025
CVE: CVE-2025-24399
GHSA: GHSA-q9cm-88jx-3vfw
Severity: High
Exploit:

CVSS v3:

Severity: Unknown
Score:
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWEs:

CWE-178
CWE-276

Affected Software
References

Software	From	Fixed in
org.jenkins-ci.plugins / oic-auth	-	4.453.v4d7765c854f4
jenkins / openid_connect_authentication	-	4.438.440.v3f5f201de5dc
jenkins / openid_connect_authentication	4.444.vd4c54f157201	4.453.v4d7765c854f4

https://github.com/jenkinsci/oic-auth-plugin/commit/4d7765c854f4f5e6e3c26ed950a26042a7527875
https://www.jenkins.io/security/advisory/2025-01-22/#SECURITY-3461

Vulnerability Database

289,871

CVE-2025-24399