Jenkins OpenID Connect Provider Plugin Incorrectly Validates Crafted Build ID Tokens
In Jenkins OpenID Connect Provider Plugin 96.vee8ed882ec4d and earlier the generation of build ID Tokens uses potentially overridden values of environment variables, in conjunction with certain other plugins allowing attackers able to configure jobs to craft a build ID Token that impersonates a trusted job, potentially gaining unauthorized access to external services.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Java / Kotlin (Maven) | io.jenkins.plugins:oidc-provider | < 111.v29fd614b_3617 | 111.v29fd614b_3617 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2025-47884
- https://github.com/jenkinsci/oidc-provider-plugin/commit/29fd614b36171048ddc78a995ce44bd12bd7997d
- https://github.com/jenkinsci/oidc-provider-plugin
- https://github.com/jenkinsci/oidc-provider-plugin/releases/tag/111.v29fd614b_3617
- https://www.jenkins.io/security/advisory/2025-05-14/#SECURITY-3574
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:L- Weakness (CWE)
CWE-284- Platform
- Java / Kotlin (Maven)
- Package
io.jenkins.plugins:oidc-provider- Disclosed
- 14.05.2025
- Updated
- 11.10.2026 12:21
Sources and licenses
OSV / GitHub Advisory Database - GHSA-q7c3-x7hm-qq72 - CC BY 4.0
Vulnerability history: io.jenkins.plugins:oidc-provider
All published vulnerabilities of this package (Java / Kotlin (Maven)), newest first. Shows whether this is a one-off slip or a package that needs watching.
This is the only known vulnerability of this package.
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.