CVE-2025-53669: Jenkins VAddy Plugin Vulnerability Exposes Plaintext API Auth Keys
Summary
CVE-2025-53669: Jenkins VAddy Plugin vulnerability exposes plaintext keys on its job configuration form. Affects org.jenkins-ci.plugins:vaddy-plugin versions < 1.2.8. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins VAddy Plugin is an extension for Jenkins that integrates with the VAddy service, allowing users to manage and monitor their VAddy API interactions directly from Jenkins. This plugin is designed to streamline the deployment and testing processes by providing seamless access to VAddy's features. However, it has a critical security flaw that can expose sensitive API authentication keys in plaintext on the job configuration form.
Vulnerability Detail
The vulnerability in the Jenkins VAddy Plugin arises from the failure to mask Vaddy API Auth Keys displayed on the job configuration form. This oversight allows unauthorized users or attackers to observe and capture these keys, potentially leading to unauthorized access to the VAddy service and associated data. The vulnerability affects versions 1.2.8 and earlier, and it is classified under CWE-256, which pertains to the exposure of sensitive information.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can restrict access to the Jenkins job configuration form to trusted users only, thereby minimizing the risk of unauthorized access to the API Auth Keys until the plugin is updated.
Conclusion
The Jenkins VAddy Plugin vulnerability (CVE-2025-53669) poses a significant risk by exposing plaintext API Auth Keys on the job configuration form. Users are strongly advised to update to version 1.2.9 or later to mitigate this risk. Additionally, implementing access restrictions can serve as a temporary workaround until the update is applied.
See every vulnerability recorded for org.jenkins-ci.plugins:vaddy-plugin →
FAQ
The CVSS score of this vulnerability is 4.3, indicating a moderate level of severity.
Versions 1.2.8 and earlier of the Jenkins VAddy Plugin are affected by this vulnerability.
You can use Vulert, which monitors open-source vulnerabilities in your software using just the pom.xml file. You can also check your application in the Vulert playground without any signup.
If exploited, this vulnerability could allow attackers to gain unauthorized access to the VAddy service, leading to data breaches or manipulation of sensitive information.
Yes, a patch is available in version 1.2.9 of the Jenkins VAddy Plugin, which addresses the vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:vaddy-plugin.
