CVE-2026-92138

The OAuth authorization endpoint in the Jenkins Bitbucket Server Integration Plugin 6.0.1 and earlier fails to verify the authenticity of the callback parameter (CWE-345): it takes the `oauth_callback` URL from the submitted form rather than using the callback stored server-side with the request token. An attacker can craft an authorization request whose callback points to a location they control and, with the victim completing the OAuth flow (user interaction is required), hijack the authorization and obtain an access token on the victim's behalf. With that token the attacker gains whatever access the victim's Bitbucket account grants the integration, such as reading repository content or interacting with the linked Bitbucket Server. Any Jenkins instance running the plugin at version 6.0.1 or earlier is affected. No public proof-of-concept or confirmed in-the-wild exploitation is known; the flaw carries a medium CVSS 3.1 score of 4.2, reflecting high attack complexity and low confidentiality/integrity impact.

What to do: Update the Bitbucket Server Integration plugin to the first fixed release after 6.0.1 via the Jenkins plugin manager. Administrators should review and revoke or rotate Bitbucket OAuth access tokens issued through the integration and check for suspicious authorization events. Restrict network access to the Jenkins OAuth endpoints where possible.