https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T18:26:20.406308+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2024-09497 bdu:2024-09497 2026-10-03T18:26:20.409489+00:00 bdu:2024-09497 https://cve.radiocsirt.org/vuln/euvd-2026-191309 EUVD-2026-191309 2026-10-03T18:26:20.409519+00:00 EUVD-2026-191309 https://cve.radiocsirt.org/vuln/fkie_cve-2024-47807 fkie_cve-2024-47807 2026-10-03T18:26:20.409533+00:00

Jenkins OpenId Connect Authentication Plugin 4.354.v321ce67a_1de8 and earlier does not check the `iss` (Issuer) claim of an ID Token, allowing attackers to subvert the authentication flow, potentially gaining administrator access to Jenkins.

 https://cve.radiocsirt.org/vuln/ghsa-8pjw-fff6-3mjv GHSA-8pjw-fff6-3mjv — Jenkins OpenId Connect Authentication Plugin lacks issuer claim validation 2026-10-03T18:26:20.409561+00:00

Affected: Maven: org.jenkins-ci.plugins:oic-auth

Jenkins OpenId Connect Authentication Plugin 4.354.v321ce67a_1de8 and earlier does not check the `iss` (Issuer) claim of an ID Token during its authentication flow, a value that identifies the Originating Party (IdP).

This vulnerability may allow attackers to subvert the authentication flow, potentially gaining administrator access to Jenkins.

OpenId Connect Authentication Plugin 4.355.v3a_fb_fca_b_96d4 checks the `iss` (Issuer) claim of an ID Token during its authentication flow when the Issuer is known.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2024-3071 WID-SEC-W-2024-3071 — Jenkins: Mehrere Schwachstellen 2026-10-03T18:26:20.409588+00:00

Ein entfernter, authentisierter oder anonymer Angreifer kann mehrere Schwachstellen in Jenkins und verschiedenen Jenkins Plugins ausnutzen, um Informationen offenzulegen Sicherheitsvorkehrungen zu umgehen oder seine Rechte zu erweitern.