CVE-2025-47884: Jenkins OpenID Connect Auth Bypass Flaw

CVE-2025-47884 Overview

A critical improper access control vulnerability exists in the Jenkins OpenID Connect Provider Plugin version 96.vee8ed882ec4d and earlier. The flaw stems from the build ID Token generation mechanism, which utilizes potentially overridden values of environment variables. When combined with certain other plugins, this vulnerability allows attackers with job configuration privileges to craft malicious build ID Tokens that impersonate trusted jobs, potentially gaining unauthorized access to external services that rely on these tokens for authentication.

Critical Impact

Attackers able to configure Jenkins jobs can forge build ID Tokens to impersonate trusted jobs, enabling unauthorized access to external services and potentially compromising the entire CI/CD pipeline trust model.

Affected Products

• Jenkins OpenID Connect Provider Plugin version 96.vee8ed882ec4d and earlier
• Jenkins installations using OpenID Connect Provider Plugin with job configuration access

Discovery Timeline

• May 14, 2025 - CVE-2025-47884 published to NVD
• June 12, 2025 - Last updated in NVD database

Technical Details for CVE-2025-47884

Vulnerability Analysis

This vulnerability falls under CWE-284 (Improper Access Control), affecting how the Jenkins OpenID Connect Provider Plugin generates and validates build ID Tokens. The core issue lies in the token generation process, which relies on environment variable values that can be manipulated by users with job configuration permissions.

In Jenkins CI/CD environments, build ID Tokens serve as authentication credentials that external services use to verify the identity and trustworthiness of Jenkins jobs. These tokens typically contain claims about the job name, build number, and other identifying information that external systems rely upon for authorization decisions.

The vulnerability allows an attacker with access to configure jobs to inject overridden environment variable values into the token generation process. This manipulation can result in tokens that falsely represent the job's identity, effectively allowing a less-trusted job to masquerade as a more privileged one.

Root Cause

The root cause of this vulnerability is the plugin's reliance on environment variables for constructing build ID Token claims without adequately verifying whether these values have been tampered with or overridden. Jenkins plugins can modify environment variables during the build process, and the OpenID Connect Provider Plugin fails to distinguish between legitimate system-provided values and potentially malicious user-supplied overrides.

This design flaw creates a trust boundary violation where user-controlled input directly influences security-sensitive token claims that external services depend upon for access control decisions.

Attack Vector

The attack vector requires network access and low-privilege authentication to Jenkins with job configuration permissions. An attacker would:

1. Gain access to configure a Jenkins job (directly or through another vulnerability)
2. Configure the job to override specific environment variables used in token generation
3. Trigger a build that generates a fraudulent ID Token
4. Use the forged token to authenticate to external services as a trusted job

The vulnerability has a changed scope, meaning successful exploitation impacts resources beyond the vulnerable component itself—specifically, the external services that trust these ID Tokens for authentication and authorization decisions.

The attack mechanism involves manipulating environment variable values that the OpenID Connect Provider Plugin uses when constructing JWT claims. By controlling these values, an attacker can craft tokens with arbitrary claims, effectively impersonating any job in the Jenkins instance. External services that validate these tokens based on job names or other claims would grant access based on the forged identity. Detailed technical information is available in the Jenkins Security Advisory SECURITY-3574.

Detection Methods for CVE-2025-47884

Indicators of Compromise

• Unexpected job configuration changes, particularly those modifying environment variables
• Build ID Tokens with mismatched claims compared to the actual job executing the build
• Unusual access patterns to external services from Jenkins, especially from jobs that shouldn't have such access
• Audit log entries showing environment variable modifications in sensitive jobs

Detection Strategies

• Review Jenkins job configurations for suspicious environment variable overrides that could affect token generation
• Implement token validation on receiving services to cross-verify claims against expected job identities
• Monitor Jenkins audit logs for configuration changes to jobs interacting with external services
• Compare build ID Token claims against the actual job metadata in Jenkins

Monitoring Recommendations

• Enable comprehensive audit logging in Jenkins to track all job configuration changes
• Implement alerting on external services for authentication attempts from unexpected job identities
• Regularly audit which users have job configuration permissions and restrict to minimum necessary
• Monitor for plugins that could enable environment variable manipulation in conjunction with OpenID Connect Provider

How to Mitigate CVE-2025-47884

Immediate Actions Required

• Update Jenkins OpenID Connect Provider Plugin to the latest patched version immediately
• Review and restrict job configuration permissions to trusted administrators only
• Audit existing job configurations for suspicious environment variable overrides
• Implement additional validation on external services that consume build ID Tokens

Patch Information

Jenkins has released a security update addressing this vulnerability. Administrators should update the OpenID Connect Provider Plugin to the latest available version. For detailed patch information and remediation guidance, refer to the Jenkins Security Advisory SECURITY-3574.

Workarounds

• Restrict job configuration permissions using Jenkins' Role-Based Access Control to limit who can modify jobs
• Implement additional claim validation on external services to verify token authenticity against known job characteristics
• Consider temporarily disabling the OpenID Connect Provider Plugin until patching is complete if external service access is not critical
• Use Jenkins Pipeline shared libraries with @Library to prevent arbitrary environment variable manipulation in critical jobs

# Review current OpenID Connect Provider Plugin version
# Navigate to: Manage Jenkins > Manage Plugins > Installed
# Or use Jenkins CLI:
java -jar jenkins-cli.jar -s http://jenkins-server/ list-plugins | grep openid-connect-provider

# Update plugin via CLI
java -jar jenkins-cli.jar -s http://jenkins-server/ install-plugin openid-connect-provider -restart