Vulnerability in Jenkins Project Bitbucket Server Integration Plugin
CVE-2026-92138
The OAuth authorization endpoint in Jenkins Bitbucket Server Integration Plugin 6.0.1 and earlier reads the `oauth_callback` URL from the submitted form rather than from the server-side stored request token, allowing attackers to hijack the OAuth flow and obtain an access token on behalf of the victim.
CVSS v3 metric
CVSS v3 base score 4.2 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N.
Affected products
Weakness classification (CWE)
References
- jenkinsci-cert@googlegroups.com (vendor-advisory)
Frequently asked questions
- What is CVE-2026-92138?
- CVE-2026-92138 is a medium-severity vulnerability in Jenkins Project Bitbucket Server Integration Plugin, classified under Insufficient Verification of Data Authenticity. CVSS score: 4.2/10. Published 2026-09-16.
- How severe is CVE-2026-92138?
- Medium severity. CVSS v3 base score is 4.2 out of 10.