CVE-2025-47884 json
Jenkins OpenID Connect Provider Plugin Incorrectly Validates Crafted Build ID Tokens
published 2025-05-14 17 mo ago modified 2026-06-17 4 mo ago also GHSA-q7c3-x7hm-qq72 , EUVD-2025-14884
- cvss
- 9.1
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.6%
- EPSS 0.6% chance of exploitation in 30 days, percentile 50%
- public exploits
- 0
- none known
Summary
In Jenkins OpenID Connect Provider Plugin 96.vee8ed882ec4d and earlier the generation of build ID Tokens uses potentially overridden values of environment variables, in conjunction with certain other plugins allowing attackers able to configure jobs to craft a build ID Token that impersonates a trusted job, potentially gaining unauthorized access to external services.
Patch / fix
- maven io.jenkins.plugins:oidc-provider 111.v29fd614b_3617
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 17 mo ago
Exploit prediction
0.64% chance of exploitation in the next 30 days, higher than 50% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CISA ADP | 3.1 | 9.1 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:L |
| CNA | 3.1 | 9.1 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:L |
| GitHub | 3.1 | 9.1 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:L |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | io.jenkins.plugins:oidc-provider | <111.v29fd614b_3617 |
111.v29fd614b_3617 |
Affected products
- Jenkins Project Jenkins OpenID Connect Provider Plugin
Classification
- Weakness
-
- CWE-284 Improper Access Control
References
-
github.com
/jenkinsci/oidc-provider-plugin/commit/29fd614b36171048ddc78a995ce44bd12bd7997d
web
-
jenkins.io
/security/advisory/2025-05-14/#SECURITY-3574
vendor-advisory, web
-
nvd.nist.gov
/vuln/detail/CVE-2025-47884
advisory
-
github.com
/jenkinsci/oidc-provider-plugin
package
-
github.com
/jenkinsci/oidc-provider-plugin/releases/tag/111.v29fd614b_3617
web
Sources
- CVE List CVE-2025-47884
- GitHub Advisory GHSA-q7c3-x7hm-qq72
- NVD CVE-2025-47884
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.