Jenkins WSO2 Oauth Plugin Authentication Bypass Vulnerability

An authentication bypass vulnerability has been identified in the WSO2 Oauth Plugin for Jenkins, affecting version 1.0 and earlier. The vulnerability arises because the 'WSO2 Oauth' security realm accepts authentication claims without proper validation. This flaw allows unauthenticated attackers to log in to controllers using any username and password, including those of non-existent users. Sessions created through this vulnerability lack any group memberships or additional authorities, although the impact may vary depending on the configured authorization strategy.

Impact

Exploitation of this vulnerability allows unauthenticated attackers to gain unauthorized access to Jenkins controllers, potentially with elevated permissions, depending on the authorization strategy in use.