Jenkins Faces Wave of Plugin Flaws, Including SAML Authentication Bypass (CVE-2025-64131)

The Jenkins project has issued a major security advisory addressing a wave of vulnerabilities, including a high-severity flaw in the SAML Plugin (CVE-2025-64131) that could allow session hijacking for Jenkins servers using SAML SSO. The advisory notes 14 security fixes across various plugins, with several crucial vulnerabilities remaining unpatched as of the publication date.

Because older SAML Plugin versions did not maintain a replay cache, a threat actor able to intercept or observe the authentication request could reuse the request token to impersonate the legitimate user, including administrative accounts. This class of flaw is especially dangerous in continuous integration environments where Jenkins credentials can provide downstream access to source code repositories, container registries and cloud infrastructure.

The October 2025 advisory also lists medium-severity vulnerabilities across several widely used plugins, alongside multiple issues described as Secrets Stored in Plain Text that could be viewed by users with limited permissions or access to the Jenkins controller file system. Admins are urged to prioritise immediate mitigation to prevent session hijacking, system compromise and secret exposure. According to The Jenkins project.