CVE-2025-64131: Jenkins SAML Plugin does not implement a replay cache

October 29, 2025 (updated November 5, 2025)

Jenkins SAML Plugin 4.583.vc68232f7018a_ and earlier does not implement a replay cache.

This allows attackers able to obtain information about the SAML authentication flow between a user’s web browser and Jenkins to replay those requests, authenticating to Jenkins as that user.

SAML Plugin 4.583.585.v22ccc1139f55 implements a replay cache that rejects replayed requests.

References

github.com/advisories/GHSA-j7r7-7qmf-xq87
github.com/jenkinsci/saml-plugin
github.com/jenkinsci/saml-plugin/commit/6170b1013daf52770de29a66aeb57893aae1d7d6
nvd.nist.gov/vuln/detail/CVE-2025-64131
www.jenkins.io/security/advisory/2025-10-29/

Code Behaviors & Features

Detect and mitigate CVE-2025-64131 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →