CVE-2025-68925: 
Java vulnerability analysis and mitigation

CVE-2025-68925 is a JWT algorithm confusion vulnerability in Jervis, a library for Job DSL plugin scripts and shared Jenkins pipeline libraries. The flaw exists in versions prior to 2.2, where the verifyJsonWebToken method in SecurityIO.groovy fails to validate that the JWT header specifies "alg":"RS256", enabling potential JWT forgery attacks. It was disclosed on January 13, 2026, via a GitHub Security Advisory. The CVSS v3.1 base score is 5.3 (Medium), while the CVSS v4.0 base score is 6.9 (Medium) (GitHub Advisory).

The root cause is classified as CWE-347 (Improper Verification of Cryptographic Signature). The vulnerable code in SecurityIO.groovy (lines 244–249) tokenizes the JWT, extracts the header/payload and signature, and calls verifyRS256Base64Url without first checking that the JWT header's alg field is set to RS256. This omission enables algorithm substitution attacks (CAPEC-475), where an attacker could craft a JWT specifying a different or weaker algorithm in the header, potentially bypassing signature verification. The attack is network-accessible and requires no authentication or user interaction (GitHub Advisory, Patch Commit).

Successful exploitation could allow an attacker to forge JWT tokens, potentially impersonating legitimate users or systems that rely on Jervis's JWT validation for authentication. The primary integrity impact is limited to the JWT validation layer used for GitHub App authentication within Jenkins pipelines. The maintainer notes that internally the severity is low since JWT is only intended to interface with GitHub, but external users integrating Jervis into broader systems should treat the severity as moderate (GitHub Advisory).

1. Identify target: Locate a Jenkins environment using Jervis versions prior to 2.2 for GitHub App authentication via JWT.
2. Craft malicious JWT header: Construct a JWT with a modified header that specifies an algorithm other than RS256 (e.g., "alg":"none" or a symmetric algorithm like HS256).
3. Forge JWT payload: Create a JWT payload with desired claims (e.g., a specific GitHub App ID or user identity).
4. Submit forged token: Present the crafted JWT to the Jervis-based system. Because verifyJsonWebToken does not validate the alg field in the header before calling verifyRS256Base64Url, the signature check may be bypassed depending on the algorithm substitution used.
5. Achieve authentication bypass: If successful, the forged token is accepted, allowing the attacker to impersonate a legitimate GitHub App or user within the Jenkins pipeline context (GitHub Advisory).

Upgrade Jervis to version 2.2 or later, which explicitly validates that the JWT header's alg field matches the expected RS256 algorithm and performs additional JWT structure validation. As a workaround for those unable to upgrade immediately, the advisory recommends using an alternate JWT library that enforces algorithm validation. Additionally, audit any JWT tokens validated by vulnerable Jervis versions to identify potential compromise, and review Jenkins Job DSL plugin configurations and shared pipeline libraries that depend on Jervis (GitHub Advisory, Patch Commit).

The vulnerability was noted by security aggregators and community members shortly after disclosure, with mentions on Mastodon (infosec.exchange) and various CVE tracking platforms. The maintainer (samrocketman) self-reported the issue and characterized the internal severity as low, while advising external users to treat it as moderate. No significant media coverage or major vendor statements beyond the original advisory have been identified (GitHub Advisory).