CVE-2023-50770 Password stored in a recoverable format by Jenkins OpenId Connect Authentication Plugin

Medium 6.7 Published 13 Dec 2023 Updated 13 Feb 2025

Attackers with file system access can recover plaintext admin passwords from the Jenkins OpenId Connect plugin, leading to full administrative control.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2023-50770?

CVE-2023-50770 is a medium-severity vulnerability in Jenkins OpenId Connect Authentication Plugin, published on 13 Dec 2023. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Jenkins OpenId Connect Authentication Plugin 2.6 and earlier stores a password of a local user account used as an anti-lockout feature in a recoverable format, allowing attackers with access to the Jenkins controller file system to recover the plain text password of that account, likely gaining administrator access to Jenkins.

Weakness: CWE-522

Which versions are affected by CVE-2023-50770?

2 open source packages ship an affected version, including org.jenkins-ci.plugins:oic-auth. It affects 1 product.

Package	Affected	Fixed in
`org.jenkins-ci.plugins:oic-auth` Maven	All versions	`4.229.vf736b`
`org.jenkins-ci.plugins:oic-auth` Maven	All versions	`4.229.vf736b`

Products include Jenkins Openid.

How do I fix CVE-2023-50770?

Upgrade org.jenkins-ci.plugins:oic-auth to 4.229.vf736b or later.

Is CVE-2023-50770 being exploited?

There is no known exploitation of CVE-2023-50770 in the wild and no public exploit code.

Sources

Also known as GHSA-6r5w-jjr5-qvgr.