4.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-53668

CVE-2025-53668: Jenkins VAddy Plugin vulnerability exposes unencrypted keys to certain authenticated users

Jenkins VAddy Plugin 1.2.8 and earlier stores Vaddy API Auth Keys unencrypted in job config.xml files on the Jenkins controller, where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-53668

CVE-2025-53668:

4.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
org.jenkins-ci.plugins:vaddy-plugin	maven	<= 1.2.8

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The analysis of the Jenkins VAddy Plugin vulnerability (CVE-2025-53668) reveals a critical flaw in how sensitive information is managed. The root cause of the vulnerability is the storage of the Vaddy API Auth Key in an unencrypted format. This issue is located in the VaddyPlugin.java file.

The key findings are:

Insecure Data Storage: The VaddyPlugin class constructor, annotated with @DataBoundConstructor, accepts the authKey as a standard String. Jenkins plugins should use the hudson.util.Secret class to handle sensitive data like API keys. By using a String, the key is persisted in plain text within the config.xml file of any job that uses this plugin.
Data Exposure: The getAuthKey() method provides direct, unmasked access to the stored API key. This means that any part of the Jenkins environment with access to the VaddyPlugin object can retrieve the key in plain text.

The combination of these two factors results in the unencrypted storage of a sensitive credential, which can be viewed by any user with Item/Extended Read permission or file system access to the Jenkins controller. The vulnerability is not in the use of the key but in its improper storage, making the constructor the primary vulnerable function.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.