cve.bz

CVE-2025-47884

9.1 criticalEPSS 0.6%

Critical (9.1) in jenkins openid connect provider. EPSS 0.6% chance of exploitation in the next 30 days. Fixed in io.jenkins.plugins:oidc-provider 111.v29fd614b_3617.

In Jenkins OpenID Connect Provider Plugin 96.vee8ed882ec4d and earlier the generation of build ID Tokens uses potentially overridden values of environment variables, in conjunction with certain other plugins allowing attackers able to configure jobs to craft a build ID Token that impersonates a trusted job, potentially gaining unauthorized access to external services.

Severity

CVSS 3.1

9.1 critical
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:L
EPSS
0.6% chance of exploitation in the next 30 days; higher than 50% of CVEs (scores of 2026-10-31)
CWE
CWE-284
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-q7c3-x7hm-qq72Mavenio.jenkins.plugins:oidc-provider<111.v29fd614b_3617111.v29fd614b_3617

References

Check your stackJSON