Jenkins Bitbucket OAuth Plugin CVE-2026-48924

Exploitation requires that the target Jenkins instance has the Bitbucket OAuth Plugin version 0.17 or earlier installed and actively configured as the authentication mechanism - instances using other authentication providers are not affected. The attacker requires no account or privileges on the Jenkins server (PR:N per CVSS vector). User interaction is mandatory: the victim must click a crafted login URL delivered via phishing, social engineering, or a compromised link (UI:R). The attack does not execute code, escalate privileges, or exfiltrate data directly; its impact is limited to redirecting the authenticated session to an attacker-specified URL, enabling downstream phishing. Exploitation is limited to scenarios where the attacker can deliver a believable login link to a target - reducing risk for organizations with strong phishing-awareness programs or that do not expose Jenkins login pages externally.

The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N scores 4.3 (Medium). Attack vector is Network with Low complexity and no privileges required, making the vulnerability broadly accessible. However, User Interaction Required (UI:R) is a meaningful friction point - successful exploitation depends on a victim clicking a crafted link, which limits automated or mass exploitation. Scope is Unchanged and there is no confidentiality or availability impact; only a Low integrity impact is recorded, reflecting the redirect's indirect ability to manipulate user behavior rather than directly modify data. EPSS data was not provided in available intelligence, so probabilistic exploitation likelihood cannot be quantified. The vulnerability is not listed in the CISA KEV catalog and no POC has been identified, further supporting a lower operational priority. Real-world risk is primarily reputational and credential-theft-oriented: an attacker who successfully targets a Jenkins administrator or developer via this redirect could harvest Bitbucket or internal credentials on a spoofed page. Organizations with externally exposed Jenkins login endpoints and no additional phishing controls face the highest practical risk.

An attacker identifies a Jenkins instance using the vulnerable Bitbucket OAuth Plugin and crafts a login URL containing a redirect parameter pointing to an attacker-controlled phishing site designed to mimic Bitbucket or an internal portal. The attacker delivers this URL via a targeted phishing email to a Jenkins developer or administrator. The victim clicks the link, completes the legitimate Bitbucket OAuth flow, and is transparently redirected to the attacker's site, which then solicits credentials or captures session context under the appearance of a legitimate service. No public POC exists at time of analysis, but the attack requires only standard knowledge of OAuth redirect parameter manipulation.