CVE-2023-24424
Description
Jenkins OpenId Connect Authentication Plugin 2.4 and earlier does not invalidate the previous session on login.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Jenkins OpenId Connect Authentication Plugin 2.4 and earlier fails to invalidate previous session on login, enabling session fixation attacks.
Vulnerability
The Jenkins OpenId Connect Authentication Plugin up to version 2.4 fails to invalidate the previous session when a user logs in [1]. This means that after a successful login, the old session remains valid.
Exploitation
An attacker who has obtained a valid session token for a user (for example, via session fixation or by tricking the user into using a known session ID) could potentially continue to use that session even after the user logs in with their credentials. This could allow the attacker to access the victim's Jenkins account.
Impact
If exploited, this vulnerability could lead to unauthorized access to Jenkins resources, including job configurations, build logs, and credentials. The attacker could potentially escalate privileges or perform actions as the authenticated user.
Mitigation
Users of the Jenkins OpenId Connect Authentication Plugin should upgrade to version 2.5 or later, which includes a fix for this issue. No workarounds are known. [1]
AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
org.jenkins-ci.plugins:oic-authMaven | < 2.5 | 2.5 |
Affected products
2- Range: unspecified
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
3- github.com/advisories/GHSA-vxmh-p52j-h33mghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2023-24424ghsaADVISORY
- www.jenkins.io/security/advisory/2023-01-24/ghsaWEB
News mentions
1- Jenkins Security Advisory 2023-01-24Jenkins Security Advisories · Jan 24, 2023