{"id":"CVE-2025-24399","details":"Jenkins OpenId Connect Authentication Plugin 4.452.v2849b_d3945fa_ and earlier, except 4.438.440.v3f5f201de5dc, treats usernames as case-insensitive, allowing attackers on Jenkins instances configured with a case-sensitive OpenID Connect provider to log in as any user by providing a username that differs only in letter case, potentially gaining administrator access to Jenkins.","aliases":["GHSA-q9cm-88jx-3vfw"],"modified":"2026-07-10T03:06:45.185930Z","published":"2025-01-22T17:15:13.853Z","references":[{"type":"ADVISORY","url":"https://www.jenkins.io/security/advisory/2025-01-22/#SECURITY-3461"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/jenkinsci/oic-auth-plugin","events":[{"introduced":"0"},{"fixed":"3f5f201de5dc4013ae242722403a86a95b63aaad"},{"introduced":"d4c54f157201ba48f3d78d08307af43c4e1b6924"},{"fixed":"4d7765c854f4f5e6e3c26ed950a26042a7527875"}],"database_specific":{"cpe":"cpe:2.3:a:jenkins:openid_connect_authentication:*:*:*:*:*:jenkins:*:*","extracted_events":[{"introduced":"0"},{"fixed":"4.438.440.v3f5f201de5dc"},{"introduced":"4.444.vd4c54f157201"},{"fixed":"4.453.v4d7765c854f4"}],"source":"CPE_RANGE"}}],"versions":["4.438.v6e62f6782770","4.452.v2849b_d3945fa_","4.444.vd4c54f157201","4.421.v5422614eb_e0a_","4.418.vccc7061f5b_6d","4.411.v990b_9d36e74e","4.409.ve864b_f48b_0f3","4.388.v4f73328eb_d2c","4.371.vc7c0c06e8a_f5","4.355.v3a_fb_fca_b_96d4","4.354.v321ce67a_1de8","4.350.v347c3b_8b_9d95","4.346.v10401f543622","4.340.ve70636c6590e","4.331.vd925b_f76f3a_c","4.330.v6fdfc07513e3","4.329.v994d3f265d68","4.324.vfd49d010926b_","4.320.v23537cb_a_b_5c6","4.303.v84089a_708ea_7","4.299.v5ca_eb_6a_f3e6d","4.297.vcddb_d8a_e4694","4.290.v6f5e8da_e98b_2","4.284.v0cc21de03d37","4.279.vca_c1e2fdd24b_","next","4.269.va_7526f34f306","4.257.v5360e8489e8b_","4.250.v5a_d993226437","4.239.v325750a_96f3b_","4.238.v0021f710b_b_f4","4.236.v4124503b_a_f88","4.229.vf736b_fec02f4","4.228.v0c3e8682ff1f","4.227.v36610663f760","4.225.v03326773b_44b_","4.224.v62720cfa_026e","4.223.v503b_9a_75a_8a_f","oic-auth-3.0","oic-auth-2.6","oic-auth-2.5","oic-auth-2.4","oic-auth-2.3","oic-auth-2.2","oic-auth-2.1","oic-auth-2.0","oic-auth-1.8","oic-auth-1.7","oic-auth-1.6","oic-auth-1.5","oic-auth-1.4","oic-auth-1.3","oic-auth-1.2","oic-auth-1.1","oic-auth-1.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-24399.json","vanir_signatures_modified":"2026-07-10T03:06:45Z","vanir_signatures":[{"digest":{"function_hash":"71790431978255330690840632366832172916","length":110},"id":"CVE-2025-24399-11294c80","signature_type":"Function","signature_version":"v1","source":"https://github.com/jenkinsci/oic-auth-plugin/commit/4d7765c854f4f5e6e3c26ed950a26042a7527875","target":{"file":"src/test/java/org/jenkinsci/plugins/oic/SecurityRealmConfigurationFIPSTest.java","function":"escapeHatchThrowsException"},"deprecated":false},{"target":{"file":"src/test/java/org/jenkinsci/plugins/oic/TestRealm.java","function":"TestRealm"},"deprecated":false,"digest":{"function_hash":"92339488683552919304618169202355811251","length":817},"id":"CVE-2025-24399-25e2650a","signature_type":"Function","signature_version":"v1","source":"https://github.com/jenkinsci/oic-auth-plugin/commit/4d7765c854f4f5e6e3c26ed950a26042a7527875"},{"signature_version":"v1","source":"https://github.com/jenkinsci/oic-auth-plugin/commit/4d7765c854f4f5e6e3c26ed950a26042a7527875","target":{"file":"src/test/java/org/jenkinsci/plugins/oic/TestRealm.java"},"deprecated":false,"digest":{"line_hashes":["159248819485680531025194786911732097141","339006640461263996001964936801635034713","22081426634109343006674938703645955805","72420844902488574905172378283379477628","200645436539131617160813460550745326840","255029042819156871292067274587823226312","210136858134134117770154592777303541727","138299684812145598888425198843408212167","220813415252913801677747992238609416653","311166172882498453125573946312019731287","124724664725159082281821260165382122148","241698953473854457028693848754184370832","135493171011005191016914937291042276926","229287564008375828068096994441832805916","273265371621046681966058172853011395004"],"threshold":0.9},"id":"CVE-2025-24399-29b67e28","signature_type":"Line"},{"id":"CVE-2025-24399-4855a828","signature_type":"Function","signature_version":"v1","source":"https://github.com/jenkinsci/oic-auth-plugin/commit/4d7765c854f4f5e6e3c26ed950a26042a7527875","target":{"file":"src/test/java/org/jenkinsci/plugins/oic/SecurityRealmConfigurationFIPSTest.java","function":"readresolve"},"deprecated":false,"digest":{"function_hash":"203478221271522253572740313549881183225","length":202}},{"signature_version":"v1","source":"https://github.com/jenkinsci/oic-auth-plugin/commit/3f5f201de5dc4013ae242722403a86a95b63aaad","target":{"file":"src/main/java/org/jenkinsci/plugins/oic/OicSecurityRealm.java"},"deprecated":false,"digest":{"line_hashes":["322461487782937796133791808475135473115","105344850659363704372853321460015650660","97489288069188998948116358426038463426","223479405681745195348368252362806442590","302711407631571022385312063737125150220","171327288396072686942004704842839645015","181756894829738664951636316829369577762","337118886049616093044512697716890473178","268702562666521644228381551217226993990","275134389792844704311379386487872601427","257393841318378162632066990951653856861","132290698468758116451436166747181291930","269164999757640056744981561687653057564","230904748141772376488404653587502253417","17016662699818905200461257943909823389","201842754010417450013020399235022722910","331674106621316476420190146626711589136","18405806831038452263297717469252489943","51129096705258866326271158081060395071","162255358518681189662743117731298066644","71901280125182888598771527985896636686","195071287563146152880450457024189097801","88589717751246450769094490700832978307","70200046239378138689314141504283369612","136393193752885154605165327968839524391","280594458184678070939474818295261775887","185322036680041267445109789435622795874","4018181233112214549315201898986217347","300251758529049714451995143990115440126"],"threshold":0.9},"id":"CVE-2025-24399-54edb00e","signature_type":"Line"},{"deprecated":false,"digest":{"function_hash":"162154435502172740736316643599492711444","length":181},"id":"CVE-2025-24399-5deebc32","signature_type":"Function","signature_version":"v1","source":"https://github.com/jenkinsci/oic-auth-plugin/commit/3f5f201de5dc4013ae242722403a86a95b63aaad","target":{"file":"src/test/java/org/jenkinsci/plugins/oic/SecurityRealmConfigurationFIPSTest.java","function":"escapeHatchToFalse"}},{"source":"https://github.com/jenkinsci/oic-auth-plugin/commit/3f5f201de5dc4013ae242722403a86a95b63aaad","target":{"file":"src/main/java/org/jenkinsci/plugins/oic/OicSecurityRealm.java","function":"OicSecurityRealm"},"deprecated":false,"digest":{"length":354,"function_hash":"247625722925303008465492101288037838688"},"id":"CVE-2025-24399-5e59fbed","signature_type":"Function","signature_version":"v1"},{"source":"https://github.com/jenkinsci/oic-auth-plugin/commit/4d7765c854f4f5e6e3c26ed950a26042a7527875","target":{"file":"src/test/java/org/jenkinsci/plugins/oic/SecurityRealmConfigurationFIPSTest.java","function":"escapeHatchToFalse"},"deprecated":false,"digest":{"function_hash":"162154435502172740736316643599492711444","length":181},"id":"CVE-2025-24399-60649da4","signature_type":"Function","signature_version":"v1"},{"signature_version":"v1","source":"https://github.com/jenkinsci/oic-auth-plugin/commit/4d7765c854f4f5e6e3c26ed950a26042a7527875","target":{"file":"src/test/java/org/jenkinsci/plugins/oic/SecurityRealmConfigurationFIPSTest.java"},"deprecated":false,"digest":{"line_hashes":["16542728570776235475771276927279473996","63972560285708423195149848050605577513","113661293223453984661515758284366817234","142533828800454276993943441136818449986","245098414483421526031132017631099152103","175392909599322583149892923732105357549","228766941038956389804995924986779761482","115426292500187615300771380489453808675","198866052926937045526822944378267828474","156995100225828416882347977497507267546","40079601793268211092017533577444728754","168152826039125229931032170930996819756","128957903560954252554176022903360527109","88984259554262805910403768292104634382"],"threshold":0.9},"id":"CVE-2025-24399-658ee635","signature_type":"Line"},{"digest":{"line_hashes":["322461487782937796133791808475135473115","105344850659363704372853321460015650660","97489288069188998948116358426038463426","223479405681745195348368252362806442590","320054043818350945864232224377123200834","430688143498372029150787719664049896","292650230376679549248084233477048101304","125966837863055832968166924150034188007","268702562666521644228381551217226993990","275134389792844704311379386487872601427","257393841318378162632066990951653856861","132290698468758116451436166747181291930","269164999757640056744981561687653057564","230904748141772376488404653587502253417","17016662699818905200461257943909823389","201842754010417450013020399235022722910","331674106621316476420190146626711589136","18405806831038452263297717469252489943","51129096705258866326271158081060395071","162255358518681189662743117731298066644","71901280125182888598771527985896636686","195071287563146152880450457024189097801","88589717751246450769094490700832978307","70200046239378138689314141504283369612","136393193752885154605165327968839524391","280594458184678070939474818295261775887","185322036680041267445109789435622795874","4018181233112214549315201898986217347","300251758529049714451995143990115440126"],"threshold":0.9},"id":"CVE-2025-24399-6a8dcf5d","signature_type":"Line","signature_version":"v1","source":"https://github.com/jenkinsci/oic-auth-plugin/commit/4d7765c854f4f5e6e3c26ed950a26042a7527875","target":{"file":"src/main/java/org/jenkinsci/plugins/oic/OicSecurityRealm.java"},"deprecated":false},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/jenkinsci/oic-auth-plugin/commit/4d7765c854f4f5e6e3c26ed950a26042a7527875","target":{"file":"src/test/java/org/jenkinsci/plugins/oic/OicSecurityRealmFipsTest.java"},"deprecated":false,"digest":{"line_hashes":["223748232701679418603221556591987714053","38412950971664111232715666380509582444","318281444644602704963405661830849850608","1650605894927286184407034295920304527","83650182607347088240180903903180517991","32654117308393925311903141950460171231","252137375346536615594722158537303261044"],"threshold":0.9},"id":"CVE-2025-24399-6fffda52"},{"target":{"file":"src/test/java/org/jenkinsci/plugins/oic/OicSecurityRealmFipsTest.java"},"deprecated":false,"digest":{"line_hashes":["223748232701679418603221556591987714053","38412950971664111232715666380509582444","318281444644602704963405661830849850608","1650605894927286184407034295920304527","83650182607347088240180903903180517991","32654117308393925311903141950460171231","252137375346536615594722158537303261044"],"threshold":0.9},"id":"CVE-2025-24399-702e5217","signature_type":"Line","signature_version":"v1","source":"https://github.com/jenkinsci/oic-auth-plugin/commit/3f5f201de5dc4013ae242722403a86a95b63aaad"},{"id":"CVE-2025-24399-8199113a","signature_type":"Function","signature_version":"v1","source":"https://github.com/jenkinsci/oic-auth-plugin/commit/4d7765c854f4f5e6e3c26ed950a26042a7527875","target":{"file":"src/test/java/org/jenkinsci/plugins/oic/OicSecurityRealmFipsTest.java","function":"settingNonCompliantValuesNotAllowedTest"},"deprecated":false,"digest":{"function_hash":"35006382388053461711706714486274596861","length":599}},{"source":"https://github.com/jenkinsci/oic-auth-plugin/commit/3f5f201de5dc4013ae242722403a86a95b63aaad","target":{"file":"src/test/java/org/jenkinsci/plugins/oic/TestRealm.java"},"deprecated":false,"digest":{"line_hashes":["159248819485680531025194786911732097141","162253027441211436730780709344778901729","103041315857857432678948998349073291439","168887701347957689745894612788463668631","200645436539131617160813460550745326840","255029042819156871292067274587823226312","210136858134134117770154592777303541727","138299684812145598888425198843408212167","220813415252913801677747992238609416653","311166172882498453125573946312019731287","124724664725159082281821260165382122148","241698953473854457028693848754184370832","135493171011005191016914937291042276926","229287564008375828068096994441832805916","273265371621046681966058172853011395004"],"threshold":0.9},"id":"CVE-2025-24399-9a90e711","signature_type":"Line","signature_version":"v1"},{"source":"https://github.com/jenkinsci/oic-auth-plugin/commit/3f5f201de5dc4013ae242722403a86a95b63aaad","target":{"file":"src/test/java/org/jenkinsci/plugins/oic/TestRealm.java","function":"TestRealm"},"deprecated":false,"digest":{"function_hash":"92339488683552919304618169202355811251","length":817},"id":"CVE-2025-24399-a20882e8","signature_type":"Function","signature_version":"v1"},{"id":"CVE-2025-24399-b4b01bb9","signature_type":"Function","signature_version":"v1","source":"https://github.com/jenkinsci/oic-auth-plugin/commit/3f5f201de5dc4013ae242722403a86a95b63aaad","target":{"file":"src/test/java/org/jenkinsci/plugins/oic/OicSecurityRealmFipsTest.java","function":"settingNonCompliantValuesNotAllowedTest"},"deprecated":false,"digest":{"function_hash":"35006382388053461711706714486274596861","length":599}},{"target":{"file":"src/main/java/org/jenkinsci/plugins/oic/OicSecurityRealm.java","function":"OicSecurityRealm"},"deprecated":false,"digest":{"function_hash":"247625722925303008465492101288037838688","length":354},"id":"CVE-2025-24399-e5876eb3","signature_type":"Function","signature_version":"v1","source":"https://github.com/jenkinsci/oic-auth-plugin/commit/4d7765c854f4f5e6e3c26ed950a26042a7527875"},{"digest":{"function_hash":"203478221271522253572740313549881183225","length":202},"id":"CVE-2025-24399-f2866b7b","signature_type":"Function","signature_version":"v1","source":"https://github.com/jenkinsci/oic-auth-plugin/commit/3f5f201de5dc4013ae242722403a86a95b63aaad","target":{"function":"readresolve","file":"src/test/java/org/jenkinsci/plugins/oic/SecurityRealmConfigurationFIPSTest.java"},"deprecated":false},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/jenkinsci/oic-auth-plugin/commit/3f5f201de5dc4013ae242722403a86a95b63aaad","target":{"file":"src/test/java/org/jenkinsci/plugins/oic/SecurityRealmConfigurationFIPSTest.java","function":"escapeHatchThrowsException"},"deprecated":false,"digest":{"function_hash":"71790431978255330690840632366832172916","length":110},"id":"CVE-2025-24399-f6d0800f"},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["16542728570776235475771276927279473996","63972560285708423195149848050605577513","113661293223453984661515758284366817234","142533828800454276993943441136818449986","245098414483421526031132017631099152103","175392909599322583149892923732105357549","228766941038956389804995924986779761482","115426292500187615300771380489453808675","198866052926937045526822944378267828474","156995100225828416882347977497507267546","40079601793268211092017533577444728754","168152826039125229931032170930996819756","128957903560954252554176022903360527109","88984259554262805910403768292104634382"]},"id":"CVE-2025-24399-fc67b6fe","signature_type":"Line","signature_version":"v1","source":"https://github.com/jenkinsci/oic-auth-plugin/commit/3f5f201de5dc4013ae242722403a86a95b63aaad","target":{"file":"src/test/java/org/jenkinsci/plugins/oic/SecurityRealmConfigurationFIPSTest.java"}}]}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}