CVE-2026-48924: Jenkins Bitbucket OAuth Plugin Redirect URL Vulnerability
Summary
CVE-2026-48924: Jenkins Bitbucket OAuth Plugin does not restrict the redirect URL after login. Affects org.jenkins-ci.plugins:bitbucket-oauth versions < 0.18. Fixed in 0.18. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Jenkins Bitbucket OAuth Plugin is a widely used plugin that enables Jenkins to authenticate users via Bitbucket using OAuth. This plugin simplifies the integration of Jenkins with Bitbucket, allowing for seamless continuous integration and deployment workflows. However, versions 0.17 and earlier of this plugin are susceptible to a critical vulnerability that compromises user security.
Vulnerability Detail
The Jenkins Bitbucket OAuth Plugin versions 0.17 and earlier do not restrict the redirect URL after a user logs in. This oversight allows attackers to exploit the authentication process by redirecting users to malicious sites after they have successfully logged into Jenkins. Such phishing attacks can lead to unauthorized access to sensitive information, as users may unknowingly provide their credentials to attackers posing as legitimate services.
How To Fix
Minimum fixed version
0.18
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can manually verify the redirect URLs after authentication to ensure they are being directed to legitimate Jenkins pages. However, this is not a foolproof solution and should not replace updating the plugin.
Conclusion
The Jenkins Bitbucket OAuth Plugin vulnerability (CVE-2026-48924) poses a significant risk due to its lack of redirect URL restrictions. It is crucial for users to update to version 0.18 or later to safeguard against potential phishing attacks. Utilizing tools like Vulert can help monitor and manage vulnerabilities effectively.
See every vulnerability recorded for org.jenkins-ci.plugins:bitbucket-oauth →
FAQ
The CVSS score of this vulnerability is 4.3, indicating a moderate severity level.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The primary risk is that attackers can redirect users to malicious sites, potentially leading to credential theft and unauthorized access to sensitive information.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software using just the pom.xml file.
If an immediate update is not possible, ensure that users are aware of the potential phishing risks and advise them to verify redirect URLs after logging in.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:bitbucket-oauth.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
