Read the docs
TI-2025-30298 Aliases CVE-2025-47884GHSA-q7c3-x7hm-qq72

Improper access control in Jenkins OpenID Connect Provider Plugin

Priority MEDIUM 40CWE-284Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
Low · High · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and GitHub. Impact type from CWE-284.

Summary

In Jenkins OpenID Connect Provider Plugin 96.vee8ed882ec4d and earlier the generation of build ID Tokens uses potentially overridden values of environment variables, in conjunction with certain other plugins allowing attackers able to configure jobs to craft a build ID Token that impersonates a trusted job, potentially gaining unauthorized access to external services.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0064 50th percentileScored 2026-11-07
Fix Fixed io.jenkins.plugins:oidc-provider (Maven): 111.v29fd614b_3617

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
JenkinsJenkins OpenID Connect Provider Pluginup to 96.vee8ed882ec4d—No fix listedCNA
—io.jenkins.plugins:oidc-provider (Maven)before 111.v29fd614b_3617111.v29fd614b_3617Patch availableGHSA-q7c3-x7hm-qq72
  • Jenkins OpenID Connect Provider Plugin VendorJenkins Affected up to 96.vee8ed882ec4d Fixed in — No fix listed CNA
  • io.jenkins.plugins:oidc-provider (Maven) Vendor— Affected before 111.v29fd614b_3617 Fixed in 111.v29fd614b_3617 Patch available GHSA-q7c3-x7hm-qq72

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:jenkins:openid_connect_provider:*:*:*:*:*:jenkins:*:*up to 96.vee8ed882ec4dVulnerableJenkins
  • cpe:2.3:a:jenkins:openid_connect_provider:*:*:*:*:*:jenkins:*:* Versions up to 96.vee8ed882ec4d Vulnerable ·Jenkins

Remediation

  • Fix · GHSA-q7c3-x7hm-qq72 io.jenkins.plugins:oidc-provider (Maven) Fixed in 111.v29fd614b_3617 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-47884
  2. 2026-10-03 Alias added: GHSA-q7c3-x7hm-qq72
  3. 2026-10-23 EPSS moved to the 50th–90th percentile

References

Advisory 2

Other 3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences