CVE-2023-41935: Jenkins Azure Ad

High severity, CVSS 7.5. EPSS: 0.8% chance of exploitation in the next 30 days.

Jenkins Azure AD Plugin 396.v86ce29279947 and earlier, except 378.380.v545b_1154b_3fb_, uses a non-constant time comparison function when checking whether the provided and expected CSRF protection nonce are equal, potentially allowing attackers to use statistical methods to obtain a valid nonce.

Affected products

• Jenkins Azure Ad: up to and including 348.vefd011eea_20b; from 378.vd6e2874a_69eb, up to and including 396.v86ce29279947

Published 2023-09-06. Last modified 2026-06-17.