OC
Product
Openid Connect Authentication
7
CVEs
0
On KEV
8.8
Max CVSS
0
New 30D
Severity mix
Critical 0High 5Medium 2Low 0
Watch
Add Openid Connect Authentication to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-24399 | 8.8 | Jan 22 | Jenkins OpenId Connect Authentication Plugin 4.452.v2849b_d3945fa_ and earlier, except 4.438.440.v3f5f201de5dc, treats usernames as case-insensitive, allowing attackers on Jenkins… Affected: before 4.438.440.v3f5f201de5dc; 4.444.vd4c54f157201 before 4.453.v4d7765c854f4 |
| CVE-2024-52553 | 8.8 | Nov 13 | Jenkins OpenId Connect Authentication Plugin 4.418.vccc7061f5b_6d and earlier does not invalidate the previous session on login Affected: before 4.421.v5422614eb_e0a |
| CVE-2023-24424 | 8.8 | Jan 26 | Jenkins OpenId Connect Authentication Plugin 2.4 and earlier does not invalidate the previous session on login Affected: before 2.5 |
| CVE-2024-47807 | 8.1 | Oct 2 | Jenkins OpenId Connect Authentication Plugin 4.354.v321ce67a_1de8 and earlier does not check the `iss` (Issuer) claim of an ID Token, allowing attackers to subvert the… Affected: before 4.355.v3a_fb_fca_b_96d4 |
| CVE-2024-47806 | 8.1 | Oct 2 | Jenkins OpenId Connect Authentication Plugin 4.354.v321ce67a_1de8 and earlier does not check the `aud` (Audience) claim of an ID Token, allowing attackers to subvert the… Affected: before 4.355.v3a_fb_fca_b_96d4 |
| CVE-2023-50771 | 6.1 | Dec 13 | Jenkins OpenId Connect Authentication Plugin 2.6 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins, allowing attackers to… Affected: through 2.6 |
| CVE-2019-1003021 | 4.3 | Feb 6 | An exposure of sensitive information vulnerability exists in Jenkins OpenId Connect Authentication Plugin 1.4 and earlier in OicSecurityRealm/config.jelly that allows attackers… Affected: through 1.4 |
Showing 7