CVE-2025-64131: Jenkins SAML Plugin does not implement a replay cache

October 29, 2025 (updated November 5, 2025)

Jenkins SAML Plugin 4.583.vc68232f7018a_ and earlier does not implement a replay cache.

This allows attackers able to obtain information about the SAML authentication flow between a user’s web browser and Jenkins to replay those requests, authenticating to Jenkins as that user.

SAML Plugin 4.583.585.v22ccc1139f55 implements a replay cache that rejects replayed requests.

References

github.com/advisories/GHSA-j7r7-7qmf-xq87
github.com/jenkinsci/saml-plugin
github.com/jenkinsci/saml-plugin/commit/6170b1013daf52770de29a66aeb57893aae1d7d6
nvd.nist.gov/vuln/detail/CVE-2025-64131
www.jenkins.io/security/advisory/2025-10-29/

Code Behaviors & Features

Detect and mitigate CVE-2025-64131 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →