GitHub Advisoryadvisory · Maven

GHSA-r8fj-rff6-f7h5 Jenkins Bitbucket OAuth Plugin does not restrict the redirect URL after login

MEDIUM Published 2026-05-27 Modified 2026-07-01 Official page ↗
Aliases
CVE-2026-48924
Ecosystem
Maven
Packages
org.jenkins-ci.plugins:bitbucket-oauth
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Weaknesses
CWE-601
Reviewed
2026-07-01

Affected packages

• Maven org.jenkins-ci.plugins:bitbucket-oauth: < 0.18 → fixed in 0.18

Description

Jenkins Bitbucket OAuth Plugin 0.17 and earlier does not restrict the redirect URL after login. This allows attackers to perform phishing attacks by having users go to a Jenkins URL that will forward them to a different site after successful authentication. Bitbucket OAuth Plugin 0.18 only redirects to relative (Jenkins) URLs.

Related

Alias · CVE (1)

  • CVE-2026-48924 Jenkins Bitbucket OAuth Plugin 0.17 and earlier does not restrict the redirect URL after login, allowing attackers to perform phishing… vulnerability

Weakness · CWE (1)

  • CWE-601 URL Redirection to Untrusted Site weakness

References