Vulnerability record · CVE-2018-1000602 · published 26 June 2018

CVE-2018-1000602: Jenkins saml vulnerability

Jenkins · Saml

A session fixation vulnerability exists in Jenkins SAML Plugin 1.0.6 and earlier in SamlSecurityRealm.java that allows unauthorized attackers to impersonate another users if they can control the pre-authentication session.

5.9 CVSS 3.0 Medium EPSS 0.85% · top 43.4% CWE-384 · CWE-384

5.9CVSS 3.0 base score, v2 4.3

0.85%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

2References

17 Jun 2026Last modified by NVD

Description

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Saml Jenkins

References

Link	Tags
https://jenkins.io/security/advisory/2018-06-25/#SECURITY-916	Vendor Advisory
https://jenkins.io/security/advisory/2018-06-25/#SECURITY-916	Vendor Advisory

Track CVE-2018-1000602 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.8CVE-2021-21678Jenkins saml cross-site request forgery vulnerabilityJenkins SAML Plugin 2.0.7 and earlier allows attackers to craft URLs that would bypass the CSRF protection of any target URL in Jenkins.EPSS 0.81%31 Aug 2021 7.5CVE-2025-64131Jenkins saml authentication bypass by capture-replay vulnerabilityJenkins SAML Plugin 4.583.vc68232f7018a_ and earlier does not implement a replay cache, allowing attackers able to obtain information about the SAML …EPSS 0.44%29 Oct 2025

Source: NIST National Vulnerability Database (record CVE-2018-1000602), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.