CVE-2018-1000173: A session fixaction vulnerability exists in Jenkins Google Login Plugin 1.3 and older in GoogleOAuth2Securi...

Security readout for executives and security teams

Jenkins instances using Google Login Plugin 1.3 or older may let an attacker impersonate another user if the attacker can control the victim’s pre-login session. The source material does not provide CVSS scoring, but the business risk is account takeover in affected Jenkins environments. Exposure is limited to Jenkins deployments using Google Login Plugin 1.3 or older. Risk is most relevant where attackers can influence or control pre-authentication sessions. Treat this as a priority fix for Jenkins environments using the affected plugin. User impersonation in CI/CD can create downstream risk to source code, build systems, and deployment trust. Mitigation focus: Identify Jenkins instances using Google Login Plugin.; Check installed Google Login Plugin versions for 1.3 or older.; Review the Jenkins advisory for fixed-version guidance..

Prepared

Jun 7, 2026, 13:40 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.