Introduction
A single replayed authentication request can give an attacker full access to Jenkins automation infrastructure, putting source code, deployment pipelines, and credentials at risk. CVE-2025-64131 is a critical flaw in the Jenkins SAML Plugin. It affects organizations that rely on SAML single sign-on for access control.
About Jenkins: Jenkins is an open source automation server, widely used for continuous integration and deployment by organizations of all sizes. Plugins connect it to a wide range of tools and authentication providers. The SAML Plugin lets Jenkins act as a SAML 2.0 service provider, which is how enterprises use single sign-on with it. Jenkins is estimated to be used by tens of thousands of organizations worldwide, so a flaw in how it authenticates users has a wide impact.
Technical information
CVE-2025-64131 affects Jenkins SAML Plugin versions 4.583.vc68232f7018a_ and earlier. The plugin's SAML authentication flow has no replay cache. In SAML 2.0, the identity provider issues a signed assertion to the user's browser, and the browser presents it to the service provider (Jenkins) to authenticate the user. Best practices and the SAML specification require the service provider to track assertion IDs and reject any assertion it has already processed, so that a captured assertion cannot be replayed.
In the affected versions, the Jenkins SAML Plugin does not track assertion IDs or keep a replay cache. If an attacker captures a valid SAML assertion (for example, by sniffing network traffic, compromising a client, or abusing proxy logs), they can replay it to Jenkins at any time within the assertion's validity window. Jenkins accepts the assertion and authenticates the attacker as the original user, with no sign that the assertion was already used. This is classified as CWE-294 (Authentication Bypass by Capture-replay).
The attacker does not need the user's credentials and does not need to compromise the identity provider. Capturing one valid SAML assertion is enough. Once they have it, exploitation is trivial, and the impact depends on the privileges of the compromised account. An attacker can reach source code, CI/CD pipelines, credentials, and possibly production environments if Jenkins is integrated with deployment systems.
No code snippets or detection methods have been published as of this writing.
Affected systems and versions
- Jenkins SAML Plugin versions 4.583.vc68232f7018a_ and earlier are affected.
- Version 4.583.585.v22ccc1139f55 fixes the vulnerability.
- Any Jenkins instance that uses the SAML Plugin for authentication and runs a vulnerable version is at risk.
Vendor security history
Jenkins has a long history as an open source automation platform, and its plugins have repeatedly been a source of security issues. Authentication and access control plugins, the SAML Plugin among them, have had earlier vulnerabilities including CSRF, improper permission checks, and XML parsing flaws. The Jenkins project usually responds quickly with advisories and patches. Still, the fact that issues as fundamental as missing replay cache logic keep turning up shows that plugin development needs more rigorous security review.
