Jenkins CAS Plugin Session Fixation vulnerability

HIGH 8.8CVE-2023-32997 · GHSA-hjh8-9gxh-cx4x · Published 16/05/2023 · updated 17/06/2026

In short

CVE-2023-32997 is a HIGH (CVSS 8.8) vulnerability affecting org.jenkins-ci.plugins:cas-plugin, cas (jenkins).
Chance of exploitation in the next 30 days (EPSS): 0.79%, higher than 56.4% of all vulnerabilities.
Fix: update to 1.6.3 or later.

Package	Affected versions	Patched versions
org.jenkins-ci.plugins:cas-plugin Maven	`< 1.6.3`	`1.6.3`
cas jenkins	`≤ 1.6.2`	No fix yet

Jenkins CAS Plugin 1.6.2 and earlier does not invalidate the existing session on login.

This allows attackers to use social engineering techniques to gain administrator access to Jenkins.

CAS Plugin 1.6.3 invalidates the existing session on login.

NVD description

Jenkins CAS Plugin 1.6.2 and earlier does not invalidate the previous session on login.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.