CVE Intelligence

Jenkins Project Jenkins SAML Plugin vulnerabilities

🔔 Create alert RSS Version checker

Published CVEs affecting Jenkins Project Jenkins SAML Plugin: 2 record(s), with affected versions and fixes.

CVE-2026-84668 High · 8.8 CWE-284 Sep 2, 2026
Improper Access Control in Jenkins Project Jenkins SAML Plugin
Jenkins SAML Plugin 4.618.v441a_27fa_46d2 and earlier allows overwriting the SAML identity provider metadata file through Stapler data binding, allowing attackers to replace it with attacker-controlled content and authenticate as any user.
CVE-2025-64131 High · 7.5 CWE-294 Oct 29, 2025
Authentication Bypass by Capture-replay in Jenkins Saml
Jenkins SAML Plugin 4.583.vc68232f7018a_ and earlier does not implement a replay cache, allowing attackers able to obtain information about the SAML authentication flow between a user's web browser and Jenkins to replay those requests, authenticating to Jenkins as that user.