CVE-2025-24399: Jenkins OpenID Connect Auth Bypass Flaw

CVE-2025-24399 Overview

Jenkins OpenId Connect Authentication Plugin version 4.452.v2849b_d3945fa_ and earlier (except version 4.438.440.v3f5f201de5dc) contains an authentication bypass vulnerability due to improper case handling of usernames. The plugin treats usernames as case-insensitive while some OpenID Connect identity providers treat them as case-sensitive, creating a dangerous mismatch that allows attackers to impersonate any user, including administrators.

Critical Impact

Attackers can gain administrator access to Jenkins instances by logging in with a username that differs only in letter case from a legitimate administrator account, potentially compromising the entire CI/CD pipeline and connected systems.

Affected Products

• Jenkins OpenId Connect Authentication Plugin versions up to and including 4.452.v2849b_d3945fa_
• All Jenkins instances using the affected plugin with case-sensitive OpenID Connect providers
• Excludes patched version 4.438.440.v3f5f201de5dc

Discovery Timeline

• 2025-01-22 - Jenkins Security Advisory SECURITY-3461 published
• 2025-01-22 - CVE-2025-24399 published to NVD
• 2025-05-07 - Last updated in NVD database

Technical Details for CVE-2025-24399

Vulnerability Analysis

This vulnerability stems from a case-sensitivity mismatch between the Jenkins OpenId Connect Authentication Plugin and external identity providers. When an organization configures Jenkins to authenticate users via an OpenID Connect (OIDC) provider that treats usernames as case-sensitive, the plugin fails to enforce the same case-sensitivity rules. This creates an exploitable gap where the identity provider may consider admin@example.com and Admin@example.com as distinct users, while Jenkins treats them as the same account.

The attack scenario requires the attacker to have legitimate access to a case-sensitive OIDC provider where they can register or obtain credentials for a username that differs only in letter case from an existing Jenkins user. When the attacker authenticates through the OIDC flow, Jenkins incorrectly maps this to the existing user's account, granting unauthorized access with all associated privileges.

Root Cause

The root cause is classified as CWE-276 (Incorrect Default Permissions), manifesting as improper username normalization logic in the authentication plugin. The plugin applies case-insensitive comparison during the user mapping process without considering the case-sensitivity settings of the upstream identity provider. This design flaw creates a privilege escalation path when Jenkins is integrated with case-sensitive OIDC providers.

Attack Vector

The attack is network-accessible and requires low privileges to execute. An attacker needs:

1. Knowledge of an existing Jenkins username (particularly administrator accounts)
2. The ability to authenticate through the configured OIDC provider with a case-variant of that username
3. No user interaction is required for exploitation

The attack flow involves the attacker creating or accessing an account on the OIDC provider with a case-modified username (e.g., ADMIN instead of admin), then initiating authentication to Jenkins. The OIDC provider validates the attacker's credentials for the case-variant account, returns a valid token, and Jenkins maps this to the existing lower-case user account due to its case-insensitive handling.

For detailed technical information regarding the vulnerability mechanism, refer to the Jenkins Security Advisory SECURITY-3461.

Detection Methods for CVE-2025-24399

Indicators of Compromise

• Authentication logs showing successful logins with username variants that differ only in letter case
• Multiple OIDC authentication events for the same normalized username from different identity provider accounts
• Unexpected administrative actions performed by accounts with case-variant usernames
• Audit trail discrepancies between OIDC provider logs and Jenkins access logs

Detection Strategies

• Implement case-sensitive log analysis to identify username variants accessing the same Jenkins account
• Cross-reference OIDC provider authentication logs with Jenkins audit logs for case-mismatch patterns
• Deploy SIEM rules to alert on authentication events where the authenticated username differs in case from the mapped Jenkins user
• Monitor for unusual administrative activity patterns following OIDC authentications

Monitoring Recommendations

• Enable verbose authentication logging in Jenkins to capture full username details during OIDC flows
• Configure alerting for any authentication where normalized username mapping occurs
• Establish baseline behavior for administrative accounts and alert on deviations
• Regularly audit Jenkins user accounts against OIDC provider user directories for case-variant duplicates

How to Mitigate CVE-2025-24399

Immediate Actions Required

• Upgrade the Jenkins OpenId Connect Authentication Plugin to a version newer than 4.452.v2849b_d3945fa_ that includes the security fix
• If running version 4.438.x, ensure you are on 4.438.440.v3f5f201de5dc or later (this specific version includes the fix)
• Audit existing Jenkins user accounts for potential case-variant username conflicts
• Review OIDC provider logs for any historical case-manipulation authentication attempts

Patch Information

Jenkins has addressed this vulnerability in plugin updates. Organizations should update the OpenId Connect Authentication Plugin through the Jenkins Plugin Manager. The fix ensures proper case handling that aligns with the configured OIDC provider's username treatment. For complete patch details and verification, consult the Jenkins Security Advisory SECURITY-3461.

Workarounds

• Temporarily switch to an alternative authentication mechanism that properly handles case sensitivity while awaiting plugin updates
• Configure the OIDC provider to enforce case-insensitive usernames if supported, eliminating the mismatch
• Implement network-level access controls to restrict Jenkins access while vulnerable
• Create explicit deny rules in Jenkins for known case-variant usernames of critical accounts

# Verify installed plugin version
# Navigate to: Manage Jenkins -> Plugin Manager -> Installed
# Check OpenId Connect Authentication plugin version
# Ensure version is newer than 4.452.v2849b_d3945fa_
# Or specifically version 4.438.440.v3f5f201de5dc if on 4.438.x branch