TI-2025-39582 Aliases CVE-2025-64131 GHSA-j7r7-7qmf-xq87

Authentication bypass by capture-replay in Jenkins SAML Plugin

LOW 35CWE-294Published 2025-10-29 · Updated 2025-11-04

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: High
Impact type: Security bypass
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and GitHub. Impact type from CWE-294.

Summary

Jenkins SAML Plugin 4.583.vc68232f7018a_ and earlier does not implement a replay cache, allowing attackers able to obtain information about the SAML authentication flow between a user's web browser and Jenkins to replay those requests, authenticating to Jenkins as that user.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00469 40th percentileScored 2026-11-07

Fix Fixed org.jenkins-ci.plugins:saml (Maven): 4.583.585.v22ccc1139f55

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Jenkins	Jenkins SAML Plugin	up to 4.583.vc68232f7018a_	—	No fix listed	CNA
—	org.jenkins-ci.plugins:saml (Maven)	before 4.583.585.v22ccc1139f55	4.583.585.v22ccc1139f55	Patch available	GHSA-j7r7-7qmf-xq87

Jenkins SAML Plugin VendorJenkins Affected up to 4.583.vc68232f7018a_ Fixed in — No fix listed CNA
org.jenkins-ci.plugins:saml (Maven) Vendor— Affected before 4.583.585.v22ccc1139f55 Fixed in 4.583.585.v22ccc1139f55 Patch available GHSA-j7r7-7qmf-xq87

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:jenkins:saml::::::jenkins::*	before 4.583.585.v22ccc1139f55	Vulnerable	Jenkins

cpe:2.3:a:jenkins:saml:*:*:*:*:*:jenkins:*:* Versions before 4.583.585.v22ccc1139f55 Vulnerable ·Jenkins

Remediation

Fix · GHSA-j7r7-7qmf-xq87 org.jenkins-ci.plugins:saml (Maven) Fixed in 4.583.585.v22ccc1139f55 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2025-64131
2026-10-03 Alias added: GHSA-j7r7-7qmf-xq87

References

Advisory 3

Other 2

TI-2021-04758 Cross-site request forgery in Jenkins SAML Plugin CVSS 3.1HIGH 8.8
TI-2018-15957 A session fixation vulnerability exists in Jenkins SAML Plugin 1.0.6 and earlier in… CVSS 3.0MEDIUM 5.9

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences