CVE-2024-47807

Severity: high (CVSS 8.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-10-02 · updated 2026-06-17
Weakness: CWE-287

Description

Jenkins OpenId Connect Authentication Plugin 4.354.v321ce67a_1de8 and earlier does not check the `iss` (Issuer) claim of an ID Token, allowing attackers to subvert the authentication flow, potentially gaining administrator access to Jenkins.

Affected products

Jenkins Project Jenkins OpenId Connect Authentication Plugin: before 4.355.v3a_fb_fca_b_96d4 — fixed in 4.355.v3a_fb_fca_b_96d4

How to fix

Upgrade to a fixed version: Jenkins Project Jenkins OpenId Connect Authentication Plugin 4.355.v3a_fb_fca_b_96d4. Check the vendor advisory for mitigations.

References

https://www.jenkins.io/security/advisory/2024-10-02/#SECURITY-3441%20(2)

Get alerted when CVE-2024-47807 or the next vulnerability affects your stack