CVE-2026-92138: Jenkins Bitbucket OAuth Bypass Vulnerability

CVE-2026-92138 Overview

CVE-2026-92138 affects the Jenkins Bitbucket Server Integration Plugin version 6.0.1 and earlier. The OAuth authorization endpoint reads the oauth_callback URL from the submitted form instead of the server-side stored request token. Attackers can hijack the OAuth flow and obtain an access token on behalf of a victim user. The flaw maps to CWE-345: Insufficient Verification of Data Authenticity. Exploitation requires user interaction and elevated attack complexity, limiting practical impact but still enabling account compromise scenarios in continuous integration environments.

Critical Impact
An attacker who convinces a victim to complete an OAuth flow can capture an access token and act on behalf of that user against the connected Bitbucket Server instance.

Affected Products

Jenkins Bitbucket Server Integration Plugin 6.0.1
All earlier versions of the Jenkins Bitbucket Server Integration Plugin
Jenkins environments integrating with Atlassian Bitbucket Server via this plugin

Discovery Timeline

2026-09-16 - CVE-2026-92138 published to NVD alongside the Jenkins Security Advisory 2026-09-16
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-92138

Vulnerability Analysis

The Jenkins Bitbucket Server Integration Plugin implements an OAuth 1.0-style authorization endpoint. During the authorization step, the endpoint accepts an oauth_callback parameter from the submitted form. The plugin then redirects the user to that URL along with the authorized token.

The correct behavior defined by RFC 5849 requires the server to use the callback URL that the consumer registered when it obtained the request token. That value is stored server-side and bound to the request token. Reading the callback from user-controlled form input breaks that binding.

Because the plugin trusts the form-submitted value, an attacker who initiates their own OAuth request token can craft a link that sends the victim to the authorization endpoint with an attacker-controlled callback. When the victim approves the request, the resulting oauth_verifier is delivered to the attacker rather than the legitimate consumer.

Root Cause

The root cause is insufficient verification of data authenticity [CWE-345]. The endpoint fails to validate that the oauth_callback submitted at authorization time matches the value previously bound to the request token in server-side storage.

Attack Vector

Exploitation is network-based and requires victim interaction. An attacker starts a legitimate OAuth handshake to obtain a valid request token. The attacker then delivers a crafted authorization URL to the victim that includes an attacker-controlled oauth_callback. After the victim authenticates and approves the request in Bitbucket, the verifier and token are redirected to the attacker's endpoint. The attacker exchanges these for an access token scoped to the victim's identity.

The vulnerability is described in prose only. See the Jenkins Security Advisory 2026-09-16 for authoritative technical details.

Detection Methods for CVE-2026-92138

Indicators of Compromise

Unexpected OAuth authorization requests in Jenkins access logs where the oauth_callback parameter points to an external or unrecognized host
Successful token exchanges followed by API activity from IP addresses that do not match known Jenkins controller or agent ranges
New or modified Bitbucket personal access grants attributed to users who did not intentionally authorize the integration

Detection Strategies

Review Jenkins controller HTTP access logs for requests to the plugin's OAuth authorization endpoint that contain callback URLs outside your organization's approved domains
Correlate OAuth authorization events with subsequent Bitbucket API calls to identify tokens used from unexpected locations
Alert on Jenkins Bitbucket Server Integration Plugin versions 6.0.1 or earlier discovered through software inventory scans

Monitoring Recommendations

Enable verbose logging on the Jenkins controller for the Bitbucket Server Integration Plugin and forward events to a centralized log platform
Monitor Bitbucket Server audit logs for OAuth grant creation and token issuance events tied to Jenkins integrations
Track outbound redirects from the Jenkins controller and flag callbacks to domains not on an approved allowlist

How to Mitigate CVE-2026-92138

Immediate Actions Required

Upgrade the Jenkins Bitbucket Server Integration Plugin to a fixed version as identified in the Jenkins Security Advisory 2026-09-16
Revoke existing OAuth access tokens issued through the plugin and re-authorize integrations after patching
Audit Bitbucket Server for unauthorized OAuth grants and remove any tokens that cannot be attributed to a known integration

Patch Information

Refer to the Jenkins Security Advisory 2026-09-16 (SECURITY-3778) for the fixed plugin version and upgrade instructions. Apply the patched release through the Jenkins Update Center or by installing the updated .hpi file manually.

Workarounds

Disable the Jenkins Bitbucket Server Integration Plugin until the patched version is deployed if immediate upgrade is not possible
Restrict network access to the Jenkins controller so that only trusted users can reach the OAuth authorization endpoint
Instruct Jenkins users to avoid clicking OAuth authorization links received from untrusted sources while the plugin remains unpatched

bash

# Example: list installed plugin version via Jenkins CLI
java -jar jenkins-cli.jar -s https://jenkins.example.com/ \
  list-plugins | grep -i bitbucket

# Example: install a specific patched version (replace VERSION)
java -jar jenkins-cli.jar -s https://jenkins.example.com/ \
  install-plugin atlassian-bitbucket-server-integration:VERSION -restart