PT-2026-44017 · Jenkins · Bitbucket Oauth Plugin

Dyingman1 · CVE-2026-48924 · Published 2026-05-27 · Updated 2026-05-28

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Bitbucket OAuth Plugin versions prior to 0.18

Description The plugin fails to restrict the redirect URL after the login process, which enables attackers to conduct phishing attacks via open redirection.

Recommendations Update to a version later than 0.17.

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2026-48924

GHSA-R8FJ-RFF6-F7H5

Affected Products

Bitbucket Oauth Plugin

References · 7

• https://jenkins.io/security/advisory/2026-05-27/#SECURITY-3761 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-48924 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-r8fj-rff6-f7h5 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-48924 · Security Note
• https://github.com/jenkinsci/bitbucket-oauth-plugin · Note
• https://t.me/CVEtracker/55129 · Telegram Post
• https://t.me/cveNotify/165041 · Telegram Post