CVE-2025-53743: Jenkins Applitools Eyes Plugin API Key Exposure Vulnerability
Summary
CVE-2025-53743: Jenkins Applitools Eyes Plugin vulnerability does not mask API keys on its job configuration form. Affects org.jenkins-ci.plugins:applitools-eyes versions < 1.16.5. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Applitools Eyes Plugin is an integration tool that allows users to automate visual testing using Applitools' AI-powered visual testing platform. This plugin is widely used in continuous integration and continuous deployment (CI/CD) pipelines to ensure that web applications render correctly across different devices and browsers. However, the plugin has a vulnerability that affects the security of sensitive information, specifically Applitools API keys.
Vulnerability Detail
Jenkins Applitools Eyes Plugin versions 1.16.5 and earlier do not mask Applitools API keys displayed on the job configuration form. This oversight can lead to unauthorized access, as attackers may observe and capture these sensitive keys, potentially compromising the security of the associated Applitools account and any applications relying on it. The vulnerability is classified under CWE-522, which pertains to the exposure of sensitive information.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users should avoid displaying sensitive API keys in the job configuration form. Consider using environment variables or Jenkins credentials to store and manage API keys securely, ensuring they are not exposed in the UI.
Conclusion
The Jenkins Applitools Eyes Plugin vulnerability (CVE-2025-53743) poses a risk by exposing sensitive API keys in the job configuration form. Users are urged to update to the latest version to mitigate this risk and consider implementing secure practices for managing sensitive information.
See every vulnerability recorded for org.jenkins-ci.plugins:applitools-eyes →
FAQ
The vulnerability has a CVSS score of 4.3, which is classified as moderate severity.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If exploited, attackers could gain access to sensitive Applitools API keys, potentially leading to unauthorized access to your visual testing resources and compromising application security.
Yes, a patched version (1.16.6) of the Jenkins Applitools Eyes Plugin is available. Users should update to this version to mitigate the vulnerability.
CWE-522 refers to the exposure of sensitive information, which is the category under which this vulnerability falls, indicating that sensitive data is not adequately protected.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:applitools-eyes.
