CVE-2025-47889
📋 TL;DR
The Jenkins WSO2 Oauth Plugin 1.0 and earlier contains an authentication bypass vulnerability where the plugin accepts authentication claims without validation. This allows unauthenticated attackers to log into Jenkins controllers using any username and password combination, including non-existent usernames. Organizations using this plugin for authentication are affected.
💻 Affected Systems
- Jenkins WSO2 Oauth Plugin
📦 What is this software?
Wso2 Oauth by Jenkins
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of Jenkins controller with administrative access, allowing code execution, data theft, and lateral movement within the network.
Likely Case
Unauthorized access to Jenkins jobs, sensitive credentials, and build artifacts, potentially leading to supply chain attacks.
If Mitigated
Limited impact if Jenkins is isolated, uses additional authentication layers, or has strict network controls.
🎯 Exploit Status
Attack requires no authentication and minimal technical skill - simply sending any username/password to the affected endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.1
Vendor Advisory: https://www.jenkins.io/security/advisory/2025-05-14/#SECURITY-3481
Restart Required: Yes
Instructions:
1. Access Jenkins Update Center. 2. Update WSO2 Oauth Plugin to version 1.1 or later. 3. Restart Jenkins service.
🔧 Temporary Workarounds
Disable WSO2 Oauth Plugin
allTemporarily disable the vulnerable plugin until patching is possible
java -jar jenkins-cli.jar -s http://jenkins-url/ disable-plugin wso2-oauth
Switch Authentication Realm
allChange to a different authentication method in Jenkins security configuration
🧯 If You Can't Patch
- Network isolate Jenkins instance and restrict access to trusted IPs only
- Implement web application firewall rules to block authentication bypass attempts
🔍 How to Verify
Check if Vulnerable:
Check Jenkins plugin manager for WSO2 Oauth Plugin version 1.0 or earlierCheck Version:
java -jar jenkins-cli.jar -s http://jenkins-url/ list-plugins | grep wso2-oauthVerify Fix Applied:
Verify plugin version is 1.1 or later in Jenkins plugin manager📡 Detection & Monitoring
Log Indicators:
- Failed authentication attempts with non-existent usernames succeeding
- Multiple successful logins from unexpected IPs
Network Indicators:
- HTTP POST requests to /securityRealm/finishLogin with arbitrary credentials
SIEM Query:
source="jenkins.log" AND "WSO2 Oauth" AND "authenticated" AND NOT "validated"