CVE-2018-1000602: Jenkins SAML

Medium severity, CVSS 5.9. EPSS: 0.9% chance of exploitation in the next 30 days.

A session fixation vulnerability exists in Jenkins SAML Plugin 1.0.6 and earlier in SamlSecurityRealm.java that allows unauthorized attackers to impersonate another users if they can control the pre-authentication session.

Affected products

• Jenkins SAML: up to and including 1.0.6

Published 2018-06-26. Last modified 2026-06-17.