Jenkins Project Jenkins Bitbucket Server Integration Plugin vulnerabilities

🔔 Create alert RSS Version checker

Published CVEs affecting Jenkins Project Jenkins Bitbucket Server Integration Plugin: 1 record(s), with affected versions and fixes.

CVE-2026-92138 Medium · 4.2 CWE-345 Sep 16, 2026

Insufficient Verification of Data Authenticity in Jenkins Project Jenkins Bitbucket Server Integration Plugin

The OAuth authorization endpoint in Jenkins Bitbucket Server Integration Plugin 6.0.1 and earlier reads the `oauth_callback` URL from the submitted form rather than from the server-side stored request token, allowing attackers to hijack the OAuth flow and obtain an access token on behalf of the victim.