The Jenkins Active Directory Plugin 2.41.1 and earlier fails to escape user names before constructing the LDAP search filter when using the Windows native (ADSI) authentication path. This omission permits an attacker to inject LDAP wildcard characters into the filter. As a result, an unauthenticated attacker can enumerate directory entries and, by guessing or knowing a target's password, authenticate as that user without knowing the exact user name.

The vulnerability affects the Jenkins Active Directory Plugin distributed by the Jenkins Project. Versions 2.41.1 and earlier are impacted.

The flaw can be exploited through unauthenticated requests to the Jenkins AD authentication endpoint, making the attack surface large. The CVSS score is 3.7, indicating moderate risk. Because unauthenticated users can trigger the injection, the risk is high for environments exposed to the internet or untrusted networks. The EPSS score is unavailable, and the vulnerability is not listed in the CISA KEV catalog, but the potential for privilege escalation via LDAP injection warrants immediate awareness.