{"action":"Upgrade io.jenkins.plugins:oidc-provider to 111.v29fd614b_3617 or later.","affected":[{"fixed":"111.v29fd614b_3617","introduced":"0"}],"component":"io.jenkins.plugins:oidc-provider","cve_ids":["CVE-2025-47884"],"ecosystem":"Maven","epss":0.0064,"exploited":false,"fixed_versions":["111.v29fd614b_3617"],"ghsa_id":"GHSA-q7c3-x7hm-qq72","id":"tcs_01M5N98Z5C2RG37W9TCJ9NSCJ6","modified_at":"2025-05-16T20:31:23.882490Z","published_at":"2025-05-14T21:31:20Z","references":["https://osv.dev/vulnerability/GHSA-q7c3-x7hm-qq72","https://nvd.nist.gov/vuln/detail/CVE-2025-47884","https://github.com/jenkinsci/oidc-provider-plugin/commit/29fd614b36171048ddc78a995ce44bd12bd7997d","https://github.com/jenkinsci/oidc-provider-plugin","https://github.com/jenkinsci/oidc-provider-plugin/releases/tag/111.v29fd614b_3617","https://www.jenkins.io/security/advisory/2025-05-14/#SECURITY-3574"],"severity":{"label":"critical","score":9.1},"sources":[{"source":"osv","source_id":"GHSA-q7c3-x7hm-qq72","url":"https://osv.dev/vulnerability/GHSA-q7c3-x7hm-qq72"}],"summary":"Jenkins OpenID Connect Provider Plugin Incorrectly Validates Crafted Build ID Tokens"}