Session Management Flaw in Jenkins OpenId Connect Authentication Plugin

CVE-2023-24424

Summary

The Jenkins OpenId Connect Authentication Plugin versions 2.4 and earlier suffer from a session management vulnerability where the application does not properly invalidate the previous session upon user login. This flaw allows an attacker to potentially exploit existing session tokens, which can lead to unauthorized access to user accounts and sensitive information. It is critical for users to ensure that their installations of this plugin are updated to mitigate this risk and enhance their overall security posture.

References