CVE-2021-21678

Summary: CVE-2021-21678 affects Jenkins SAML Plugin 2.0.7 and earlier. The vulnerability arises from an extension point that disables CSRF protection for the URL users are redirected to after login, making it possible to bypass CSRF protections for any Jenkins URL. This is caused by the plugin’s ...

CVE-2018-1000602

The CVE-2018-1000602 entry identifies a session-fixation issue in the Jenkins SAML Plugin (versions ≤ 1.0.6) affecting the SamlSecurityRealm.java flow, allowing an attacker who controls a pre-authentication session to impersonate other users. The vulnerability is specific to the SAML Plugin imple...

CVE-2025-64131

CVE-2025-64131 concerns the Jenkins SAML Plugin (versions up to 4.583.vc68232f7018a_ and earlier) not implementing a replay cache for SAML authentication flow. The absence of a replay cache allows an attacker who can observe the SAML exchange to replay requests and authenticate as the target user...