GHSA-p89h-p4ph-4vj6

ghsaUSosv

Jenkins WSO2 Oauth Plugin Fails to Properly Authenticate User Credentials

view advisory published 2025-05-14Licence: CC-BY-4.0

In Jenkins WSO2 Oauth Plugin 1.0 and earlier, authentication claims are accepted without validation by the "WSO2 Oauth" security realm, allowing unauthenticated attackers to log in to controllers using this security realm using any username and any password, including usernames that do not exist.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2025-47889US	—	0.65% (51st)	—	2025-05-14
In Jenkins WSO2 Oauth Plugin 1.0 and earlier, authentication claims are accepted without validation by the "WSO2 Oauth" security realm, allowing unauthenticated attackers to log in…

references

External citations — patches, advisories, analysis.

https://nvd.nist.gov/vuln/detail/CVE-2025-47889ADVISORY
https://www.jenkins.io/security/advisory/2025-05-14/#SECURITY-3481WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan