4.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-53669

CVE-2025-53669: Jenkins VAddy Plugin vulnerability exposes plaintext keys on its job configuration form

Jenkins VAddy Plugin 1.2.8 and earlier does not mask Vaddy API Auth Keys displayed on the job configuration form, increasing the potential for attackers to observe and capture them.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-53669

CVE-2025-53669:

4.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
org.jenkins-ci.plugins:vaddy-plugin	maven	<= 1.2.8

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

I have analyzed the vulnerability description for CVE-2025-53669 in the Jenkins VAddy Plugin. The core of the vulnerability lies in the fact that the Vaddy API Authentication Key is displayed in plaintext on the job configuration page, making it susceptible to being captured by an attacker with sufficient permissions.

The security advisory states that version 1.2.8 and earlier are affected and that no patch was available at the time of publication. This indicates the vulnerability exists in the latest released version of the code.

My analysis of the plugin's source code, specifically the UI definition files, has pinpointed the exact location of the vulnerability. The file src/main/resources/com/vaddy/jenkins/VaddyScan/config.jelly is responsible for rendering the configuration form for the Vaddy Scan build step.

Within this file, the following line of code creates a standard text field for the authToken parameter:

<f:entry title="${%VADDY_AUTH_TOKEN}" field="authToken">
  <f:textbox />
</f:entry>

The <f:textbox /> tag generates a simple text input field, which does not mask the input. The proper, secure way to handle secrets in Jenkins configuration forms is to use the <f:password /> tag, which would render a password field that masks the entered value.

Because the form field is a standard textbox, any previously saved authToken will be rendered in plaintext in the HTML of the configuration page, visible to anyone who can view the job configuration.

The VaddyScan.java file contains the DescriptorImpl class which acts as the controller for this configuration. The authToken field in this class is where the value from the form is stored. While the storage of the key in config.xml is also a vulnerability (CVE-2025-53668), the unmasked presentation in the UI is the specific subject of CVE-2025-53669. The doCheckAuthToken method in DescriptorImpl is responsible for validating the token, but it does not play a role in how the token is displayed.

Therefore, the vulnerable "function" in a broader sense is the rendering of the configuration UI, directly caused by the use of <f:textbox /> in config.gsp. While not a traditional function call in a stack trace, this is the code that directly leads to the exposure of the secret in the user interface.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.