Jenkins SAML vulnerabilities

3 CVEs affecting Jenkins SAML, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-64131, published 2025-10-29.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2018-1000602, published 2018-06-26. Medium severity, CVSS 5.9. EPSS: 0.9% chance of exploitation in the next 30 days. A session fixation vulnerability exists in Jenkins SAML Plugin 1.0.6 and earlier in SamlSecurityRealm.java that allows unauthorized attackers to impersonate another users if they can control the…
CVE-2021-21678, published 2021-08-31. High severity, CVSS 8.8. EPSS: 0.8% chance of exploitation in the next 30 days. Jenkins SAML Plugin 2.0.7 and earlier allows attackers to craft URLs that would bypass the CSRF protection of any target URL in Jenkins.
CVE-2025-64131, published 2025-10-29. High severity, CVSS 7.5. EPSS: 0.5% chance of exploitation in the next 30 days. Jenkins SAML Plugin 4.583.vc68232f7018a_ and earlier does not implement a replay cache, allowing attackers able to obtain information about the SAML authentication flow between a user's web browser…