Jenkins OpenId Connect Authentication Plugin vulnerabilities
3 known vulnerabilities in Jenkins OpenId Connect Authentication Plugin from Jenkins. 3 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 8.8 High severity
Jenkins OpenId Connect Authentication Plugin: Incorrect Default Permissions
Jenkins OpenId Connect Authentication Plugin 4.452.v2849b_d3945fa_ and earlier, except 4.438.440.v3f5f201de5dc, treats usernames as case-insensitive, allowing attackers on Jenkins instances configured with a case-sensitive OpenID Connect provider to log in as
- 8.1 High severity
Jenkins OpenId Connect Authentication Plugin: Improper Authentication
Jenkins OpenId Connect Authentication Plugin 4.354.v321ce67a_1de8 and earlier does not check the `iss` (Issuer) claim of an ID Token, allowing attackers to subvert the authentication flow, potentially gaining administrator access to Jenkins.
- 8.1 High severity
Jenkins OpenId Connect Authentication Plugin: Improper Authentication
Jenkins OpenId Connect Authentication Plugin 4.354.v321ce67a_1de8 and earlier does not check the `aud` (Audience) claim of an ID Token, allowing attackers to subvert the authentication flow, potentially gaining administrator access to Jenkins.