GitHub Advisoryadvisory · Maven

GHSA-p89h-p4ph-4vj6 Jenkins WSO2 Oauth Plugin Fails to Properly Authenticate User Credentials

HIGH Published 2025-05-14 Modified 2025-05-16 Official page ↗
Aliases
CVE-2025-47889
Ecosystem
Maven
Packages
org.jenkins-ci.plugins:wso2id-oauth
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-1390, CWE-287
Reviewed
2025-05-16

Affected packages

• Maven org.jenkins-ci.plugins:wso2id-oauth: <= 1.0 (no fix yet)

Description

In Jenkins WSO2 Oauth Plugin 1.0 and earlier, authentication claims are accepted without validation by the "WSO2 Oauth" security realm, allowing unauthenticated attackers to log in to controllers using this security realm using any username and any password, including usernames that do not exist.

Related

Alias · CVE (1)

  • CVE-2025-47889 In Jenkins WSO2 Oauth Plugin 1.0 and earlier, authentication claims are accepted without validation by the "WSO2 Oauth" security realm,… vulnerability

Weakness · CWE (2)

  • CWE-1390 Weak Authentication weakness
  • CWE-287 Improper Authentication weakness

References