What is GHSA-p89h-p4ph-4vj6?

GHSA-p89h-p4ph-4vj6 is a security advisory published by GitHub Security Advisories with High severity. Jenkins WSO2 Oauth Plugin Fails to Properly Authenticate User Credentials

Which CVE IDs does GHSA-p89h-p4ph-4vj6 cover?

GHSA-p89h-p4ph-4vj6 covers the following CVE IDs: CVE-2025-47889. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-p89h-p4ph-4vj6?

GHSA-p89h-p4ph-4vj6 has a CVSS v3 base score of 9.8, published by GitHub Security Advisories.

Which products are affected by GHSA-p89h-p4ph-4vj6?

GHSA-p89h-p4ph-4vj6 affects 1 product, including: maven/org.jenkins-ci.plugins:wso2id-oauth:\u003c= 1.0.

GHSA-p89h-p4ph-4vj6HighCVSS 9.8

Jenkins WSO2 Oauth Plugin Fails to Properly Authenticate User Credentials

Vendor

GitHub Security Advisories

Published

May 14, 2025

Last Modified

May 19, 2025

🔗 CVE IDs covered (1)

CVE-2025-47889 →

📋 Description

In Jenkins WSO2 Oauth Plugin 1.0 and earlier, authentication claims are accepted without validation by the "WSO2 Oauth" security realm, allowing unauthenticated attackers to log in to controllers using this security realm using any username and any password, including usernames that do not exist.

🎯 Affected products1

maven/org.jenkins-ci.plugins:wso2id-oauth:<= 1.0

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2025-47889
https://www.jenkins.io/security/advisory/2025-05-14/#SECURITY-3481
https://github.com/advisories/GHSA-p89h-p4ph-4vj6