-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.jenkins-ci.plugins:google-login | maven | >= 1.0, < 1.2 | 1.2 |
Miggo AIRoot Cause AnalysisThe vulnerability stemmed from missing server-side validation of Google OAuth domain restrictions. The plugin's finishLogin handler trusted the client-controlled 'hd' parameter in the OAuth flow rather than validating the domain from the JWT token's claims. The patched commit (cb470f0) adds this validation in finishLogin by extracting the 'hd' claim from the verified ID token, confirming the vulnerable function was the unpatched version of this authentication handler.
JavaJavaKEV Misses 88% of Exploited CVEs- Get the report