CVE-2025-24399: Improper handling of case sensitivity in Jenkins OpenId Connect Authentication Plugin

January 22, 2025 (updated January 23, 2025)

The Jenkins OpenId Connect Authentication Plugin 4.452.v2849b_d3945fa_ and earlier treats usernames as case-insensitive.

On a Jenkins instance configured with a case-sensitive OpenID Connect provider, this allows attackers to log in as any user by providing a username that differs only in letter case, potentially gaining administrator access to Jenkins.

OpenId Connect Authentication Plugin 4.453.v4d7765c854f4 introduces an advanced configuration option to manage username case sensitivity, with default to case-sensitive.

References

github.com/advisories/GHSA-q9cm-88jx-3vfw
github.com/jenkinsci/oic-auth-plugin
github.com/jenkinsci/oic-auth-plugin/commit/4d7765c854f4f5e6e3c26ed950a26042a7527875
nvd.nist.gov/vuln/detail/CVE-2025-24399
www.jenkins.io/security/advisory/2025-01-22/

Detect and mitigate CVE-2025-24399 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →