CVE-2026-48924

MEDIUM

Jenkins Bitbucket OAuth Plugin < 0.17 - URL Redirection to Untrusted Site ('Open Redirect')

Title source: rule
STIX 2.1

Description

Jenkins Bitbucket OAuth Plugin 0.17 and earlier does not restrict the redirect URL after login, allowing attackers to perform phishing attacks.

References (1)

Core 1
Core References
Vendor Advisory vendor-advisory
Jenkins Security Advisory 2026-05-27
https://www.jenkins.io/security/advisory/2026-05-27/#SECURITY-3761

Scores

CVSS v3 4.3
EPSS 0.0021
EPSS Percentile 11.1%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-601
Status published
Products (3)
jenkins/bitbucket_oauth < 0.17
Jenkins Project/Jenkins Bitbucket OAuth Plugin < 0.17
org.jenkins-ci.plugins/bitbucket-oauth 0 - 0.18Maven
Published May 27, 2026
Tracked Since May 27, 2026