CVE-2026-48924: Jenkins Bitbucket OAuth Plugin Vulnerability

CVE-2026-48924 Overview

CVE-2026-48924 is an open redirect vulnerability in the Jenkins Bitbucket OAuth Plugin. Versions 0.17 and earlier fail to restrict the redirect URL processed after a successful login. Attackers can craft authentication links that redirect users to attacker-controlled domains following Jenkins login. This behavior enables phishing campaigns that abuse the trusted Jenkins origin to harvest credentials or deliver malicious content. The vulnerability is tracked under CWE-601 (URL Redirection to Untrusted Site).

Critical Impact
Attackers can leverage the trusted Jenkins login flow to redirect authenticated users to malicious destinations, supporting credential theft and malware delivery through phishing.

Affected Products

Jenkins Bitbucket OAuth Plugin version 0.17
Jenkins Bitbucket OAuth Plugin versions earlier than 0.17
Jenkins controllers integrating Bitbucket OAuth single sign-on

Discovery Timeline

2026-05-27 - CVE CVE-2026-48924 published to NVD
2026-05-27 - Jenkins Security Advisory SECURITY-3761 released
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-48924

Vulnerability Analysis

The Jenkins Bitbucket OAuth Plugin handles authentication redirection after a user completes OAuth login against Bitbucket. The plugin reads a redirect target supplied in the authentication request and forwards the user to that location once login succeeds. The plugin does not validate that the target URL points to an in-scope Jenkins host, which permits arbitrary external destinations.

An attacker constructs a Jenkins login URL containing a redirect parameter pointing to an attacker-controlled domain. The victim sees a legitimate Jenkins hostname in the initial link and proceeds with authentication. After login, the plugin forwards the browser to the attacker domain, which can mimic Jenkins or Bitbucket to capture credentials, deliver malware, or stage further attacks.

The issue requires user interaction, as victims must click the crafted link. No privileges are required to mount the attack. The vulnerability impacts integrity by enabling deceptive redirection but does not directly compromise confidentiality or availability of Jenkins data.

Root Cause

The root cause is missing validation of the post-login redirect URL inside the Bitbucket OAuth Plugin. The plugin trusts the supplied parameter without enforcing an allow-list of permitted hosts or relative paths. This pattern matches CWE-601, URL redirection to an untrusted site.

Attack Vector

The attack is network-based and relies on social engineering. An attacker sends a phishing message containing a Jenkins login link with a manipulated redirect parameter. After authentication, the victim's browser is sent to the attacker domain. See the Jenkins Security Advisory SECURITY-3761 for technical specifics on the affected redirect handling.

Detection Methods for CVE-2026-48924

Indicators of Compromise

Jenkins access logs containing OAuth login requests with redirect parameters pointing to external domains not matching the Jenkins base URL
HTTP 302 responses from Jenkins after Bitbucket OAuth callback that resolve to untrusted hosts
User reports of unexpected redirects to login pages or download prompts following Jenkins authentication

Detection Strategies

Inspect Jenkins web server logs for OAuth callback URLs containing absolute external URLs in redirect query parameters
Correlate proxy and DNS logs for outbound traffic from user workstations to unfamiliar domains immediately after Jenkins login events
Hunt for phishing emails containing Jenkins login URLs with embedded redirect parameters referencing attacker-controlled infrastructure

Monitoring Recommendations

Alert on Jenkins HTTP responses that issue redirects to hosts outside the configured Jenkins and Bitbucket domains
Monitor newly registered look-alike domains that imitate Jenkins or Bitbucket branding used by the organization
Track installed plugin versions across Jenkins controllers to identify instances still running Bitbucket OAuth Plugin 0.17 or earlier

How to Mitigate CVE-2026-48924

Immediate Actions Required

Identify all Jenkins controllers with the Bitbucket OAuth Plugin installed and record their plugin versions
Upgrade the Bitbucket OAuth Plugin to a fixed release as described in Jenkins Security Advisory SECURITY-3761
Notify Jenkins users about phishing risks involving crafted login links until upgrades are complete

Patch Information

Jenkins published Security Advisory SECURITY-3761 on 2026-05-27 covering this issue. Administrators should consult the advisory for the fixed plugin version and apply the update through the Jenkins Update Center.

Workarounds

Disable the Bitbucket OAuth Plugin until the patched version can be installed if Bitbucket SSO is not business-critical
Restrict access to Jenkins login endpoints with a reverse proxy that strips or validates redirect query parameters
Enforce phishing-resistant user training and email filtering rules to block messages referencing the Jenkins login URL with external redirect targets

bash

# Configuration example: list installed Jenkins plugins and versions via CLI
java -jar jenkins-cli.jar -s https://jenkins.example.com/ -auth admin:TOKEN \
  list-plugins | grep -i bitbucket-oauth