GHSA-6837-qgrc-x5p6

Jenkins has a CSRF vulnerability on the login form

Source: GitHub Advisory Database (reviewed) Low CVE-2025-67639

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.jenkins-ci.main:jenkins-core	>= 2.529, < 2.541	2.541
Maven	org.jenkins-ci.main:jenkins-core	< 2.528.3	2.528.3

Details

As written in the advisory (Markdown source, shown as plain text).

A cross-site request forgery (CSRF) vulnerability in Jenkins 2.540 and earlier, LTS 2.528.2 and earlier allows attackers to trick users into logging in to the attacker's account.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2025-67639 advisory
https://github.com/jenkinsci/jenkins/commit/31598feb0aa514d8978d2c27a4c9a5a9b8d80a57 web
https://github.com/jenkinsci/jenkins package
https://www.jenkins.io/security/advisory/2025-12-10/#SECURITY-1166 web