GitHub Advisoryadvisory · Maven

GHSA-j7r7-7qmf-xq87 Jenkins SAML Plugin does not implement a replay cache

HIGH Published 2025-10-29 Modified 2025-11-05 Official page ↗
Aliases
CVE-2025-64131
Ecosystem
Maven
Packages
org.jenkins-ci.plugins:saml
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-294
Reviewed
2025-10-29

Affected packages

• Maven org.jenkins-ci.plugins:saml: < 4.583.585.v22ccc1139f55 → fixed in 4.583.585.v22ccc1139f55

Description

Jenkins SAML Plugin 4.583.vc68232f7018a_ and earlier does not implement a replay cache. This allows attackers able to obtain information about the SAML authentication flow between a user’s web browser and Jenkins to replay those requests, authenticating to Jenkins as that user. SAML Plugin 4.583.585.v22ccc1139f55 implements a replay cache that rejects replayed requests.

Related

Alias · CVE (1)

  • CVE-2025-64131 Jenkins SAML Plugin 4.583.vc68232f7018a_ and earlier does not implement a replay cache, allowing attackers able to obtain information about… vulnerability

Weakness · CWE (1)

  • CWE-294 Authentication Bypass by Capture-replay weakness

References