High
Security advisory
Jenkins OpenId Connect Authentication Plugin 4.452.v2849b_d3945fa_ and earlier, except 4.438.440.v3f5f201de5dc, treats usernames as case-insensitive, allowing attackers on Jenkins instances configured with a case-sensitive OpenID Connect provider to log in as any user by providing a username that differs only in letter case, potentially gaining administrator access to Jenkins.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2025-24399
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 09:29 UTC · Revision 1
Source evidence
Jenkins OpenId Connect Authentication Plugin 4.452.v2849b_d3945fa_ and earlier, except 4.438.440.v3f5f201de5dc, treats usernames as case-insensitive, allowing attackers on Jenkins instances configured with a case-sensitive OpenID Connect provider to log in as any user by providing a username that differs only in letter case, potentially gaining administrator access to Jenkins.
osv:CVE-2025-24399
Complete source record
{
"id": "e39ce57bc9c2eec3109422d181c5b243a3a4e1f1c4c604fe457dbf2b0e35029e",
"url": "https://osv.dev/vulnerability/CVE-2025-24399",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2025-24399",
"summary": "Jenkins OpenId Connect Authentication Plugin 4.452.v2849b_d3945fa_ and earlier, except 4.438.440.v3f5f201de5dc, treats usernames as case-insensitive, allowing attackers on Jenkins instances configured with a case-sensitive OpenID Connect provider to log in as any user by providing a username that differs only in letter case, potentially gaining administrator access to Jenkins.",
"evidence": "osv:CVE-2025-24399",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2025-24399",
"aliases": [
"CVE-2025-24399",
"GHSA-q9cm-88jx-3vfw"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/jenkinsci/oic-auth-plugin",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "3f5f201de5dc4013ae242722403a86a95b63aaad"
},
{
"introduced": "d4c54f157201ba48f3d78d08307af43c4e1b6924"
},
{
"fixed": "4d7765c854f4f5e6e3c26ed950a26042a7527875"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:jenkins:openid_connect_authentication:*:*:*:*:*:jenkins:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "4.438.440.v3f5f201de5dc"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:jenkins:openid_connect_authentication:*:*:*:*:*:jenkins:*:*",
"range": [
{
"introduced": "4.444.vd4c54f157201"
},
{
"fixed": "4.453.v4d7765c854f4"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"versions": [
"4.438.v6e62f6782770",
"4.452.v2849b_d3945fa_",
"4.444.vd4c54f157201",
"4.421.v5422614eb_e0a_",
"4.418.vccc7061f5b_6d",
"4.411.v990b_9d36e74e",
"4.409.ve864b_f48b_0f3",
"4.388.v4f73328eb_d2c",
"4.371.vc7c0c06e8a_f5",
"4.355.v3a_fb_fca_b_96d4",
"4.354.v321ce67a_1de8",
"4.350.v347c3b_8b_9d95",
"4.346.v10401f543622",
"4.340.ve70636c6590e",
"4.331.vd925b_f76f3a_c",
"4.330.v6fdfc07513e3",
"4.329.v994d3f265d68",
"4.324.vfd49d010926b_",
"4.320.v23537cb_a_b_5c6",
"4.303.v84089a_708ea_7",
"4.299.v5ca_eb_6a_f3e6d",
"4.297.vcddb_d8a_e4694",
"4.290.v6f5e8da_e98b_2",
"4.284.v0cc21de03d37",
"4.279.vca_c1e2fdd24b_",
"next",
"4.269.va_7526f34f306",
"4.257.v5360e8489e8b_",
"4.250.v5a_d993226437",
"4.239.v325750a_96f3b_",
"4.238.v0021f710b_b_f4",
"4.236.v4124503b_a_f88",
"4.229.vf736b_fec02f4",
"4.228.v0c3e8682ff1f",
"4.227.v36610663f760",
"4.225.v03326773b_44b_",
"4.224.v62720cfa_026e",
"4.223.v503b_9a_75a_8a_f",
"oic-auth-3.0",
"oic-auth-2.6",
"oic-auth-2.5",
"oic-auth-2.4",
"oic-auth-2.3",
"oic-auth-2.2",
"oic-auth-2.1",
"oic-auth-2.0",
"oic-auth-1.8",
"oic-auth-1.7",
"oic-auth-1.6",
"oic-auth-1.5",
"oic-auth-1.4",
"oic-auth-1.3",
"oic-auth-1.2",
"oic-auth-1.1",
"oic-auth-1.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-24399.json",
"vanir_signatures": [
{
"id": "CVE-2025-24399-11294c80",
"digest": {
"length": 110,
"function_hash": "71790431978255330690840632366832172916"
},
"source": "https://github.com/jenkinsci/oic-auth-plugin/commit/4d7765c854f4f5e6e3c26ed950a26042a7527875",
"target": {
"file": "src/test/java/org/jenkinsci/plugins/oic/SecurityRealmConfigurationFIPSTest.java",
"function": "escapeHatchThrowsException"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2025-24399-25e2650a",
"digest": {
"length": 817,
"function_hash": "92339488683552919304618169202355811251"
},
"source": "https://github.com/jenkinsci/oic-auth-plugin/commit/4d7765c854f4f5e6e3c26ed950a26042a7527875",
"target": {
"file": "src/test/java/org/jenkinsci/plugins/oic/TestRealm.java",
"function": "TestRealm"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2025-24399-29b67e28",
"digest": {
"threshold": 0.9,
"line_hashes": [
"159248819485680531025194786911732097141",
"339006640461263996001964936801635034713",
"22081426634109343006674938703645955805",
"72420844902488574905172378283379477628",
"200645436539131617160813460550745326840",
"255029042819156871292067274587823226312",
"210136858134134117770154592777303541727",
"138299684812145598888425198843408212167",
"220813415252913801677747992238609416653",
"311166172882498453125573946312019731287",
"124724664725159082281821260165382122148",
"241698953473854457028693848754184370832",
"135493171011005191016914937291042276926",
"229287564008375828068096994441832805916",
"273265371621046681966058172853011395004"
]
},
"source": "https://github.com/jenkinsci/oic-auth-plugin/commit/4d7765c854f4f5e6e3c26ed950a26042a7527875",
"target": {
"file": "src/test/java/org/jenkinsci/plugins/oic/TestRealm.java"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2025-24399-4855a828",
"digest": {
"length": 202,
"function_hash": "203478221271522253572740313549881183225"
},
"source": "https://github.com/jenkinsci/oic-auth-plugin/commit/4d7765c854f4f5e6e3c26ed950a26042a7527875",
"target": {
"file": "src/test/java/org/jenkinsci/plugins/oic/SecurityRealmConfigurationFIPSTest.java",
"function": "readresolve"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2025-24399-54edb00e",
"digest": {
"threshold": 0.9,
"line_hashes": [
"322461487782937796133791808475135473115",
"105344850659363704372853321460015650660",
"97489288069188998948116358426038463426",
"223479405681745195348368252362806442590",
"302711407631571022385312063737125150220",
"171327288396072686942004704842839645015",
"181756894829738664951636316829369577762",
"337118886049616093044512697716890473178",
"268702562666521644228381551217226993990",
"275134389792844704311379386487872601427",
"257393841318378162632066990951653856861",
"132290698468758116451436166747181291930",
"269164999757640056744981561687653057564",
"230904748141772376488404653587502253417",
"17016662699818905200461257943909823389",
"201842754010417450013020399235022722910",
"331674106621316476420190146626711589136",
"18405806831038452263297717469252489943",
"51129096705258866326271158081060395071",
"162255358518681189662743117731298066644",
"71901280125182888598771527985896636686",
"195071287563146152880450457024189097801",
"88589717751246450769094490700832978307",
"70200046239378138689314141504283369612",
"136393193752885154605165327968839524391",
"280594458184678070939474818295261775887",
"185322036680041267445109789435622795874",
"4018181233112214549315201898986217347",
"300251758529049714451995143990115440126"
]
},
"source": "https://github.com/jenkinsci/oic-auth-plugin/commit/3f5f201de5dc4013ae242722403a86a95b63aaad",
"target": {
"file": "src/main/java/org/jenkinsci/plugins/oic/OicSecurityRealm.java"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2025-24399-5deebc32",
"digest": {
"length": 181,
"function_hash": "162154435502172740736316643599492711444"
},
"source": "https://github.com/jenkinsci/oic-auth-plugin/commit/3f5f201de5dc4013ae242722403a86a95b63aaad",
"target": {
"file": "src/test/java/org/jenkinsci/plugins/oic/SecurityRealmConfigurationFIPSTest.java",
"function": "escapeHatchToFalse"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2025-24399-5e59fbed",
"digest": {
"length": 354,
"function_hash": "247625722925303008465492101288037838688"
},
"source": "https://github.com/jenkinsci/oic-auth-plugin/commit/3f5f201de5dc4013ae242722403a86a95b63aaad",
"target": {
"file": "src/main/java/org/jenkinsci/plugins/oic/OicSecurityRealm.java",
"function": "OicSecurityRealm"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2025-24399-60649da4",
"digest": {
"length": 181,
"function_hash": "162154435502172740736316643599492711444"
},
"source": "https://github.com/jenkinsci/oic-auth-plugin/commit/4d7765c854f4f5e6e3c26ed950a26042a7527875",
"target": {
"file": "src/test/java/org/jenkinsci/plugins/oic/SecurityRealmConfigurationFIPSTest.java",
"function": "escapeHatchToFalse"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2025-24399-658ee635",
"digest": {
"threshold": 0.9,
"line_hashes": [
"16542728570776235475771276927279473996",
"63972560285708423195149848050605577513",
"113661293223453984661515758284366817234",
"142533828800454276993943441136818449986",
"245098414483421526031132017631099152103",
"175392909599322583149892923732105357549",
"228766941038956389804995924986779761482",
"115426292500187615300771380489453808675",
"198866052926937045526822944378267828474",
"156995100225828416882347977497507267546",
"40079601793268211092017533577444728754",
"168152826039125229931032170930996819756",
"128957903560954252554176022903360527109",
"88984259554262805910403768292104634382"
]
},
"source": "https://github.com/jenkinsci/oic-auth-plugin/commit/4d7765c854f4f5e6e3c26ed950a26042a7527875",
"target": {
"file": "src/test/java/org/jenkinsci/plugins/oic/SecurityRealmConfigurationFIPSTest.java"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2025-24399-6a8dcf5d",
"digest": {
"threshold": 0.9,
"line_hashes": [
"322461487782937796133791808475135473115",
"105344850659363704372853321460015650660",
"97489288069188998948116358426038463426",
"223479405681745195348368252362806442590",
"320054043818350945864232224377123200834",
"430688143498372029150787719664049896",
"292650230376679549248084233477048101304",
"125966837863055832968166924150034188007",
"268702562666521644228381551217226993990",
"275134389792844704311379386487872601427",
"257393841318378162632066990951653856861",
"132290698468758116451436166747181291930",
"269164999757640056744981561687653057564",
"230904748141772376488404653587502253417",
"17016662699818905200461257943909823389",
"201842754010417450013020399235022722910",
"331674106621316476420190146626711589136",
"18405806831038452263297717469252489943",
"51129096705258866326271158081060395071",
"162255358518681189662743117731298066644",
"71901280125182888598771527985896636686",
"195071287563146152880450457024189097801",
"88589717751246450769094490700832978307",
"70200046239378138689314141504283369612",
"136393193752885154605165327968839524391",
"280594458184678070939474818295261775887",
"185322036680041267445109789435622795874",
"4018181233112214549315201898986217347",
"300251758529049714451995143990115440126"
]
},
"source": "https://github.com/jenkinsci/oic-auth-plugin/commit/4d7765c854f4f5e6e3c26ed950a26042a7527875",
"target": {
"file": "src/main/java/org/jenkinsci/plugins/oic/OicSecurityRealm.java"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2025-24399-6fffda52",
"digest": {
"threshold": 0.9,
"line_hashes": [
"223748232701679418603221556591987714053",
"38412950971664111232715666380509582444",
"318281444644602704963405661830849850608",
"1650605894927286184407034295920304527",
"83650182607347088240180903903180517991",
"32654117308393925311903141950460171231",
"252137375346536615594722158537303261044"
]
},
"source": "https://github.com/jenkinsci/oic-auth-plugin/commit/4d7765c854f4f5e6e3c26ed950a26042a7527875",
"target": {
"file": "src/test/java/org/jenkinsci/plugins/oic/OicSecurityRealmFipsTest.java"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2025-24399-702e5217",
"digest": {
"threshold": 0.9,
"line_hashes": [
"223748232701679418603221556591987714053",
"38412950971664111232715666380509582444",
"318281444644602704963405661830849850608",
"1650605894927286184407034295920304527",
"83650182607347088240180903903180517991",
"32654117308393925311903141950460171231",
"252137375346536615594722158537303261044"
]
},
"source": "https://github.com/jenkinsci/oic-auth-plugin/commit/3f5f201de5dc4013ae242722403a86a95b63aaad",
"target": {
"file": "src/test/java/org/jenkinsci/plugins/oic/OicSecurityRealmFipsTest.java"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2025-24399-8199113a",
"digest": {
"length": 599,
"function_hash": "35006382388053461711706714486274596861"
},
"source": "https://github.com/jenkinsci/oic-auth-plugin/commit/4d7765c854f4f5e6e3c26ed950a26042a7527875",
"target": {
"file": "src/test/java/org/jenkinsci/plugins/oic/OicSecurityRealmFipsTest.java",
"function": "settingNonCompliantValuesNotAllowedTest"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2025-24399-9a90e711",
"digest": {
"threshold": 0.9,
"line_hashes": [
"159248819485680531025194786911732097141",
"162253027441211436730780709344778901729",
"103041315857857432678948998349073291439",
"168887701347957689745894612788463668631",
"200645436539131617160813460550745326840",
"255029042819156871292067274587823226312",
"210136858134134117770154592777303541727",
"138299684812145598888425198843408212167",
"220813415252913801677747992238609416653",
"311166172882498453125573946312019731287",
"124724664725159082281821260165382122148",
"241698953473854457028693848754184370832",
"135493171011005191016914937291042276926",
"229287564008375828068096994441832805916",
"273265371621046681966058172853011395004"
]
},
"source": "https://github.com/jenkinsci/oic-auth-plugin/commit/3f5f201de5dc4013ae242722403a86a95b63aaad",
"target": {
"file": "src/test/java/org/jenkinsci/plugins/oic/TestRealm.java"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2025-24399-a20882e8",
"digest": {
"length": 817,
"function_hash": "92339488683552919304618169202355811251"
},
"source": "https://github.com/jenkinsci/oic-auth-plugin/commit/3f5f201de5dc4013ae242722403a86a95b63aaad",
"target": {
"file": "src/test/java/org/jenkinsci/plugins/oic/TestRealm.java",
"function": "TestRealm"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2025-24399-b4b01bb9",
"digest": {
"length": 599,
"function_hash": "35006382388053461711706714486274596861"
},
"source": "https://github.com/jenkinsci/oic-auth-plugin/commit/3f5f201de5dc4013ae242722403a86a95b63aaad",
"target": {
"file": "src/test/java/org/jenkinsci/plugins/oic/OicSecurityRealmFipsTest.java",
"function": "settingNonCompliantValuesNotAllowedTest"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2025-24399-e5876eb3",
"digest": {
"length": 354,
"function_hash": "247625722925303008465492101288037838688"
},
"source": "https://github.com/jenkinsci/oic-auth-plugin/commit/4d7765c854f4f5e6e3c26ed950a26042a7527875",
"target": {
"file": "src/main/java/org/jenkinsci/plugins/oic/OicSecurityRealm.java",
"function": "OicSecurityRealm"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2025-24399-f2866b7b",
"digest": {
"length": 202,
"function_hash": "203478221271522253572740313549881183225"
},
"source": "https://github.com/jenkinsci/oic-auth-plugin/commit/3f5f201de5dc4013ae242722403a86a95b63aaad",
"target": {
"file": "src/test/java/org/jenkinsci/plugins/oic/SecurityRealmConfigurationFIPSTest.java",
"function": "readresolve"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2025-24399-f6d0800f",
"digest": {
"length": 110,
"function_hash": "71790431978255330690840632366832172916"
},
"source": "https://github.com/jenkinsci/oic-auth-plugin/commit/3f5f201de5dc4013ae242722403a86a95b63aaad",
"target": {
"file": "src/test/java/org/jenkinsci/plugins/oic/SecurityRealmConfigurationFIPSTest.java",
"function": "escapeHatchThrowsException"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2025-24399-fc67b6fe",
"digest": {
"threshold": 0.9,
"line_hashes": [
"16542728570776235475771276927279473996",
"63972560285708423195149848050605577513",
"113661293223453984661515758284366817234",
"142533828800454276993943441136818449986",
"245098414483421526031132017631099152103",
"175392909599322583149892923732105357549",
"228766941038956389804995924986779761482",
"115426292500187615300771380489453808675",
"198866052926937045526822944378267828474",
"156995100225828416882347977497507267546",
"40079601793268211092017533577444728754",
"168152826039125229931032170930996819756",
"128957903560954252554176022903360527109",
"88984259554262805910403768292104634382"
]
},
"source": "https://github.com/jenkinsci/oic-auth-plugin/commit/3f5f201de5dc4013ae242722403a86a95b63aaad",
"target": {
"file": "src/test/java/org/jenkinsci/plugins/oic/SecurityRealmConfigurationFIPSTest.java"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
}
],
"vanir_signatures_modified": "2026-10-24T14:56:53Z"
}
}
],
"modified": "2026-10-24T14:56:53.316728240Z",
"provider": "osv",
"references": [
"https://www.jenkins.io/security/advisory/2025-01-22/#SECURITY-3461"
],
"provider_metadata": {}
},
"related_cves": [
{
"value": "CVE-2025-24399",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 443884,
"published_at": "2025-01-22T17:15:13.853+00:00"
}