CVE-2025-47884

Jenkins OpenID Connect Provider Plugin Incorrectly Validates Crafted Build ID Tokens

9.1 CriticalFix available

In Jenkins OpenID Connect Provider Plugin 96.vee8ed882ec4d and earlier the generation of build ID Tokens uses potentially overridden values of environment variables, in conjunction with certain other plugins allowing attackers able to configure jobs to craft a build ID Token that impersonates a trusted job, potentially gaining unauthorized access to external services.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: Low
Integrity: High
Availability: Low

Exploit likelihood

0.64%Up 0.6 points since May 15, 2025

What each source reports

CVE List Score used 9.1

Record: CVE-2025-47884
CVSS 3.1: 9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:L
Weakness: CWE-284
Updated: 2026-11-02

EUVDEUVD-2025-14884 9.1

Record: EUVD-2025-14884
CVSS 3.1: 9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:L
Updated: 2026-11-02

GitHub AdvisoriesGHSA-q7c3-x7hm-qq72 9.1

Jenkins OpenID Connect Provider Plugin Incorrectly Validates Crafted Build ID Tokens

Record: GHSA-q7c3-x7hm-qq72
CVSS 3.1: 9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:L
Weakness: CWE-284
Updated: 2026-11-02

NVD 9.1

Record: CVE-2025-47884
CVSS 3.1: 9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:L
Weakness: CWE-284
Updated: 2026-11-02

OSVGHSA-q7c3-x7hm-qq72 9.1

Jenkins OpenID Connect Provider Plugin Incorrectly Validates Crafted Build ID Tokens

Record: GHSA-q7c3-x7hm-qq72
CVSS 3.1: 9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:L
Weakness: CWE-284
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`io.jenkins.plugins:oidc-provider` Maven	before 111.v29fd614b3617	111.v29fd614b3617
`io.jenkins.plugins:oidc-provider` Maven	before 111.v29fd614b_3617, plus listed versions 18.v80b_cda_0cca_8339.vb_a_d851b_03d3041.v3ea_ce9dfd6d247.v182a_02f5b_77160.v4b_9522d31cfb_ Show 4 moreShow less 62.vd67c19f7676679.v46f0066a_d81389.v3dfb_6d89b_61896.vee8ed882ec4d	111.v29fd614b_3617

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-47884 is a critical vulnerability (CVSS 9.1) in Jenkins Openid Connect Provider, published May 14, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.64%, the 50th percentile. Fixed in io.jenkins.plugins:oidc-provider 111.v29fd614b3617.