CVE-2021-21678

Summary: CVE-2021-21678 affects Jenkins SAML Plugin 2.0.7 and earlier. The vulnerability arises from an extension point that disables CSRF protection for the URL users are redirected to after login, making it possible to bypass CSRF protections for any Jenkins URL. This is caused by the plugin’s ...

CVE-2018-1000602

The CVE-2018-1000602 entry identifies a session-fixation issue in the Jenkins SAML Plugin (versions ≤ 1.0.6) affecting the SamlSecurityRealm.java flow, allowing an attacker who controls a pre-authentication session to impersonate other users. The vulnerability is specific to the SAML Plugin imple...

CVE-2025-64131

The Jenkins SAML Plugin versions 4.583.vc68232f7018a_ and earlier are vulnerable to a replay attack because they do not implement a replay cache in the SAML authentication flow. An attacker who intercepts SAML authentication messages between a user's web browser and Jenkins can replay those reque...