Skip to content
OpenAdvisories
Medium · 4.3 CVE-2026-48924 EUVD-2026-32515GHSA-r8fj-rff6-f7h5

Jenkins Bitbucket OAuth Plugin does not restrict the redirect URL after login

Published May 27, 2026 · Updated May 27, 2026 · Assigned by jenkins

Vendor: Jenkins Project Product: Jenkins Bitbucket OAuth Plugin Package: org.jenkins-ci.plugins:bitbucket-oauth Category: Web / CMS Ecosystem: Maven

Description

Jenkins Bitbucket OAuth Plugin 0.17 and earlier does not restrict the redirect URL after login, allowing attackers to perform phishing attacks.

Affected products

VendorProductAffectedFixed
Jenkins Project Jenkins Bitbucket OAuth Plugin ≤ 0.17 —

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.jenkins-ci.plugins:bitbucket-oauth < 0.18 0.18 GHSA-r8fj-rff6-f7h5

Advisories 1

References