{"id":"CVE-2025-68925","aliases":["EUVD-2026-2023","GHSA-5pq9-5mpr-jj85"],"status":"published","title":"Jervis has a JWT Algorithm Confusion Vulnerability","description":"Jervis is a library for Job DSL plugin scripts and shared Jenkins pipeline libraries. Prior to 2.2, the code doesn't validate that the JWT header specifies \"alg\":\"RS256\". This vulnerability is fixed in 2.2.","severity":{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00153,"percentile":0.04535,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-347"],"published":"2026-01-13T14:56:04Z","modified":"2026-10-28T02:31:00Z","fixes":[{"ecosystem":"Maven","package":"net.gleske:jervis","fixed_in":["2.2"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"net.gleske:jervis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2"}]}]},{"source":"osv","ecosystem":"Maven","package":"net.gleske:jervis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2"}]}],"versions":["0.1","0.10","0.11","0.12","0.13","0.2","0.3","0.4","0.5","0.5.1","0.5.2","0.6","0.7","0.8","0.9","1.0","1.1","1.2","1.3","1.4","1.5","1.6","1.7","2.0","2.0.1","2.1"]}],"products":[{"vendor":"samrocketman","product":"jervis"}],"references":[{"url":"https://github.com/samrocketman/jervis/security/advisories/GHSA-5pq9-5mpr-jj85","tags":["x_refsource_CONFIRM","Patch","Vendor Advisory","advisory","web"]},{"url":"https://github.com/samrocketman/jervis/commit/c3981ff71de7b0f767dfe7b37a2372cb2a51974a","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"https://github.com/samrocketman/jervis/blob/157d2b63ffa5c4bb1d8ee2254950fd2231de2b05/src/main/groovy/net/gleske/jervis/tools/SecurityIO.groovy#L244-L249","tags":["web"]},{"url":"http://github.com/samrocketman/jervis/commit/c3981ff71de7b0f767dfe7b37a2372cb2a51974a","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68925","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-5pq9-5mpr-jj85"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/68xxx/CVE-2025-68925.json","tags":["advisory"]},{"url":"https://github.com/samrocketman/jervis","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2025-68925","title":"Jervis has a JWT Algorithm Confusion Vulnerability","description":"Jervis is a library for Job DSL plugin scripts and shared Jenkins pipeline libraries. Prior to 2.2, the code doesn't validate that the JWT header specifies \"alg\":\"RS256\". This vulnerability is fixed in 2.2.","status":"published","published":"2026-01-13T19:30:05.513Z","modified":"2026-01-13T19:53:48.021Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"}],"cwes":["CWE-347"],"updated_at":"2026-11-02T14:32:35.742256Z"}],"euvd":[{"id":"EUVD-2026-2023","description":"Jervis is a library for Job DSL plugin scripts and shared Jenkins pipeline libraries. Prior to 2.2, the code doesn't validate that the JWT header specifies \"alg\":\"RS256\". This vulnerability is fixed in 2.2.","status":"published","published":"2026-01-13T19:30:05Z","modified":"2026-01-13T19:53:48Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T19:48:52.739812Z"}],"ghsa":[{"id":"GHSA-5pq9-5mpr-jj85","title":"Jervis Has a JWT Algorithm Confusion Vulnerability","description":"### Vulnerability\n\nhttps://github.com/samrocketman/jervis/blob/157d2b63ffa5c4bb1d8ee2254950fd2231de2b05/src/main/groovy/net/gleske/jervis/tools/SecurityIO.groovy#L244-L249\n\nThe code doesn't validate that the JWT header specifies `\"alg\":\"RS256\"`.\n\n### Impact\n\nDepending on the broader system, this could allow JWT forgery.\n\nInternally this severity is low since JWT is only intended to interface with GitHub.  External users should consider severity moderate.\n\n### Patches\n\nJervis patch will explicitly verify the algorithm in the header matches expectations and further verify the JWT structure.\n\nUpgrade to Jervis 2.2.\n\n### Workarounds\n\nExternal users should consider using an alternate JWT library or upgrade.\n\n### References\n\n- [RFC 7518: JSON Web Algorithms](https://datatracker.ietf.org/doc/html/rfc7518)","status":"published","published":"2026-01-13T14:56:04Z","modified":"2026-01-21T16:23:34Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-347"],"updated_at":"2026-11-02T14:39:18.564331Z"}],"nvd":[{"id":"CVE-2025-68925","description":"Jervis is a library for Job DSL plugin scripts and shared Jenkins pipeline libraries. Prior to 2.2, the code doesn't validate that the JWT header specifies \"alg\":\"RS256\". This vulnerability is fixed in 2.2.","status":"published","published":"2026-01-13T20:16:07.83Z","modified":"2026-06-17T09:59:50.007Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-347"],"updated_at":"2026-11-02T14:11:56.616231Z"}],"osv":[{"id":"CVE-2025-68925","title":"Jervis has a JWT Algorithm Confusion Vulnerability","description":"Jervis is a library for Job DSL plugin scripts and shared Jenkins pipeline libraries. Prior to 2.2, the code doesn't validate that the JWT header specifies \"alg\":\"RS256\". This vulnerability is fixed in 2.2.","status":"published","published":"2026-01-13T19:30:05.513Z","modified":"2026-10-28T02:31:00.025063297Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-347"],"updated_at":"2026-11-02T15:44:52.859856Z"},{"id":"GHSA-5pq9-5mpr-jj85","title":"Jervis Has a JWT Algorithm Confusion Vulnerability","description":"### Vulnerability\n\nhttps://github.com/samrocketman/jervis/blob/157d2b63ffa5c4bb1d8ee2254950fd2231de2b05/src/main/groovy/net/gleske/jervis/tools/SecurityIO.groovy#L244-L249\n\nThe code doesn't validate that the JWT header specifies `\"alg\":\"RS256\"`.\n\n### Impact\n\nDepending on the broader system, this could allow JWT forgery.\n\nInternally this severity is low since JWT is only intended to interface with GitHub.  External users should consider severity moderate.\n\n### Patches\n\nJervis patch will explicitly verify the algorithm in the header matches expectations and further verify the JWT structure.\n\nUpgrade to Jervis 2.2.\n\n### Workarounds\n\nExternal users should consider using an alternate JWT library or upgrade.\n\n### References\n\n- [RFC 7518: JSON Web Algorithms](https://datatracker.ietf.org/doc/html/rfc7518)","status":"published","published":"2026-01-13T14:56:04Z","modified":"2026-02-03T03:11:37.438351Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"},{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-347"],"updated_at":"2026-11-02T15:46:38.553953Z"}]}}