Critical severity9.8NVD Advisory· Published May 14, 2025· Updated Jun 17, 2026

CVE-2025-47889

Description

In Jenkins WSO2 Oauth Plugin 1.0 and earlier, authentication claims are accepted without validation by the "WSO2 Oauth" security realm, allowing unauthenticated attackers to log in to controllers using this security realm using any username and any password, including usernames that do not exist.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
org.jenkins-ci.plugins:wso2id-oauthMaven	<= 1.0	—

Affected products

Jenkins Project/Wso2 OAuth
cpe:2.3:a:jenkins:wso2_oauth:*:*:*:*:*:jenkins:*:*
Range: <=1.0
ghsa-coords
pkg:maven/org.jenkins-ci.plugins/wso2id-oauth
Range: <= 1.0
Jenkins Project/WSO2 Oauth Plugincpe-rescue
Range: 1.0

Patches

Vulnerability mechanics

References

github.com/advisories/GHSA-p89h-p4ph-4vj6ghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2025-47889ghsaADVISORY
www.jenkins.io/security/advisory/2025-05-14/nvdVendor AdvisoryWEB

News mentions

Jenkins Security Advisory 2025-05-14
Jenkins Security Advisories · May 14, 2025

cvss	0.637
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000