Vulnerability DatabaseCVE-2025-47889

CVE-2025-47889:
Java vulnerability analysis and mitigation

Overview

CVE-2025-47889 is a critical authentication bypass vulnerability discovered in Jenkins WSO2 Oauth Plugin version 1.0 and earlier, disclosed on May 14, 2025. The vulnerability affects the WSO2 Oauth security realm component of the Jenkins automation server, where authentication claims are accepted without proper validation (Jenkins Advisory, NVD).

Technical details

The vulnerability has received a CVSS v3.1 score of 9.8 (CRITICAL) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The flaw stems from the WSO2 Oauth Plugin's failure to validate authentication claims in the WSO2 Oauth security realm. Sessions created through this vulnerability lack additional authorities and group memberships, including the 'authenticated' group membership (Wiz, Jenkins Advisory).

Impact

The impact varies based on the configured authorization strategy in Jenkins. With the 'Logged-in users can do anything' strategy, attackers gain Overall/Administer permissions. Under the 'Role-based strategy', attackers receive permissions assigned directly to the specified user. For 'Matrix-based security' and 'Project-based Matrix Authorization Strategy', attackers obtain permissions assigned directly to the user but not group-based permissions (Jenkins Advisory, Wiz).

Mitigation and workarounds

As of the advisory publication on May 14, 2025, no official fix is available for the WSO2 Oauth Plugin. Organizations using this plugin should consider disabling or uninstalling it until a security patch is released (Jenkins Advisory).

Community reactions

The vulnerability has garnered significant attention in the security community, particularly due to its critical severity rating and the widespread use of Jenkins in enterprise environments. Security researchers have emphasized the serious nature of authentication bypass vulnerabilities in CI/CD infrastructure (Security Online).