CVE-2025-47889

Published May 14, 2025

Last updated 7 days ago

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-47889 affects the WSO2 Oauth Plugin version 1.0 and earlier for Jenkins. The vulnerability stems from the plugin's security realm accepting authentication claims without proper validation. This lack of validation allows unauthenticated attackers to log in to Jenkins controllers using any username and password, even if those usernames don't actually exist. Successful exploitation could lead to unauthorized access to Jenkins controllers.

Description
In Jenkins WSO2 Oauth Plugin 1.0 and earlier, authentication claims are accepted without validation by the "WSO2 Oauth" security realm, allowing unauthenticated attackers to log in to controllers using this security realm using any username and any password, including usernames that do not exist.
Source
jenkinsci-cert@googlegroups.com
NVD status
Awaiting Analysis

Risk scores

CVSS 3.1

Type
Secondary
Base score
9.8
Impact score
5.9
Exploitability score
3.9
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity
CRITICAL

Social media

Hype score
Not currently trending

References

Sources include official advisories and independent security research.