6.9

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-68925

CVE-2025-68925: Jervis Has a JWT Algorithm Confusion Vulnerability

Jervis is a library for Job DSL plugin scripts and shared Jenkins pipeline libraries. Prior to 2.2, the code doesn't validate that the JWT header specifies "alg":"RS256". This vulnerability is fixed in 2.2.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-68925

CVE-2025-68925:

6.9

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
net.gleske:jervis	maven	< 2.2	2.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The analysis of the provided patch clearly indicates a vulnerability within the net.gleske.jervis.tools.SecurityIO.verifyJsonWebToken function. The vulnerability, as described, is a classic JWT Algorithm Confusion attack. The provided commit c3981ff71de7b0f767dfe7b37a2372cb2a51974a directly addresses this by adding checks for the JWT structure and, most importantly, for the expected alg (algorithm) in the JWT header. Before the patch, the code would take any token, and attempt to verify it, allowing an attacker to switch the algorithm to a weaker one (like 'none' or a symmetric one where the public key is used as a secret), thus forging a valid token. The patch mitigates this by hardcoding the expectation of the RS256 algorithm. The changes in src/main/groovy/net/gleske/jervis/tools/SecurityIO.groovy are the primary evidence for this conclusion.

Vulnerable functions

net.gleske.jervis.tools.SecurityIO.verifyJsonWebToken

src/main/groovy/net/gleske/jervis/tools/SecurityIO.groovy

The function `verifyJsonWebToken` was vulnerable to JWT algorithm confusion. It did not validate the algorithm specified in the JWT header before verifying the signature. An attacker could provide a JWT with the algorithm set to 'none' or a symmetric algorithm like 'HS256' and bypass signature verification, leading to token forgery. The patch adds explicit validation to ensure the algorithm is 'RS256' and that the JWT has the correct structure.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.