| Package | Affected versions | Patched versions |
|---|---|---|
| org.jenkins-ci.plugins:oic-auth | < 4.421.v5422614eb | 4.421.v5422614eb |
| openid connect authentication | < 4.421.v5422614eb_e0a | 4.421.v5422614eb_e0a |
Jenkins OpenId Connect Authentication Plugin 4.418.vccc7061f5b_6d and earlier does not invalidate the previous session on login. This allows attackers to use social engineering techniques to gain administrator access to Jenkins. OpenId Connect Authentication Plugin 4.421.v5422614eb_e0a_ invalidates the existing session on login.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free