~ / search / GHSA-r8fj-rff6-f7h5

GHSA-r8fj-rff6-f7h5

Jenkins Bitbucket OAuth Plugin does not restrict the redirect URL after login

Source: GitHub Advisory Database (reviewed) Moderate CVE-2026-48924

Packages

EcosystemPackageAffectedFixed in
Maven org.jenkins-ci.plugins:bitbucket-oauth < 0.18 0.18

Details

As written in the advisory (Markdown source, shown as plain text).

Jenkins Bitbucket OAuth Plugin 0.17 and earlier does not restrict the redirect URL after login. This allows attackers to perform phishing attacks by having users go to a Jenkins URL that will forward them to a different site after successful authentication. Bitbucket OAuth Plugin 0.18 only redirects to relative (Jenkins) URLs.

References

External links from the advisory. They lead to third-party sites.