CVE-2023-24424 Jenkins OpenId Connect Authentication Plugin 2.4 and earlier does not invalidate the previous session on login

Description

Jenkins OpenId Connect Authentication Plugin 2.4 and earlier does not invalidate the previous session on login.

Affected products and versions

Product	Affected versions	Fixed in
Jenkins OpenId Connect Authentication Plugin 2.4	earliest → 2.4	No fix stated

Other CVEs of Jenkins OpenId Connect Authentication Plugin

The 8 CVEs of Jenkins OpenId Connect Authentication Plugin →

CVE-2025-24399 Jenkins OpenId Connect Authentication Plugin 4.452.v2849b_d3945fa_ and earlier, except 4.438.440.v3f5f201de5dc, treats… 8.8 High CVE-2024-52553 Jenkins OpenId Connect Authentication Plugin 4.418.vccc7061f5b_6d and earlier does not invalidate the previous session… 8.8 High CVE-2024-47806 Jenkins OpenId Connect Authentication Plugin 4.354.v321ce67a_1de8 and earlier does not check the `aud` (Audience)… 8.1 High CVE-2024-47807 Jenkins OpenId Connect Authentication Plugin 4.354.v321ce67a_1de8 and earlier does not check the `iss` (Issuer) claim of… 8.1 High