Jenkins Bitbucket Server Integration Plugin
Monthly
OAuth flow hijacking in the Jenkins Bitbucket Server Integration Plugin 6.0.1 and earlier allows an attacker to substitute the callback URL used in the plugin's OAuth authorization step and capture the Bitbucket access token issued to a victim. Exploitation is not against a static endpoint: the plugin must be installed with its OAuth authorization flow in active use, the attacker must have an OAuth handshake in progress, and a victim who is already authenticated must complete the authorization step (UI:R) within a timing window the attacker must hit (AC:H). Rated only CVSS 4.2 with no confidentiality or integrity impact beyond the scope of the hijacked victim's token, this is a genuine authentication-flow flaw but a low-priority one; no public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis.
OAuth flow hijacking in the Jenkins Bitbucket Server Integration Plugin 6.0.1 and earlier allows an attacker to substitute the callback URL used in the plugin's OAuth authorization step and capture the Bitbucket access token issued to a victim. Exploitation is not against a static endpoint: the plugin must be installed with its OAuth authorization flow in active use, the attacker must have an OAuth handshake in progress, and a victim who is already authenticated must complete the authorization step (UI:R) within a timing window the attacker must hit (AC:H). Rated only CVSS 4.2 with no confidentiality or integrity impact beyond the scope of the hijacked victim's token, this is a genuine authentication-flow flaw but a low-priority one; no public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis.