https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T19:08:25.088385+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-223231 EUVD-2026-223231 2026-10-02T19:08:25.235197+00:00 EUVD-2026-223231 https://cve.radiocsirt.org/vuln/fkie_cve-2025-24399 fkie_cve-2025-24399 2026-10-02T19:08:25.235250+00:00

Jenkins OpenId Connect Authentication Plugin 4.452.v2849b_d3945fa_ and earlier, except 4.438.440.v3f5f201de5dc, treats usernames as case-insensitive, allowing attackers on Jenkins instances configured with a case-sensitive OpenID Connect provider to log in as any user by providing a username that differs only in letter case, potentially gaining administrator access to Jenkins.

 https://cve.radiocsirt.org/vuln/ghsa-q9cm-88jx-3vfw GHSA-q9cm-88jx-3vfw — Improper handling of case sensitivity in Jenkins OpenId Connect Authentication Plugin 2026-10-02T19:08:25.235291+00:00

Affected: Maven: org.jenkins-ci.plugins:oic-auth

The Jenkins OpenId Connect Authentication Plugin 4.452.v2849b_d3945fa_ and earlier treats usernames as case-insensitive.

On a Jenkins instance configured with a case-sensitive OpenID Connect provider, this allows attackers to log in as any user by providing a username that differs only in letter case, potentially gaining administrator access to Jenkins.

OpenId Connect Authentication Plugin 4.453.v4d7765c854f4 introduces an advanced configuration option to manage username case sensitivity, with default to case-sensitive.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2025-0175 WID-SEC-W-2025-0175 — Jenkins Plugins: Mehrere Schwachstellen 2026-10-02T19:08:25.235320+00:00

Ein entfernter anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Jenkins ausnutzen, um Informationen preiszugeben, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren oder erhöhte Rechte zu erlangen.