Executive brief
The Jenkins Bitbucket OAuth Plugin, which allows users to log into Jenkins using their Bitbucket accounts, contains a flaw that fails to validate redirection URLs after a user logs in. An attacker could exploit this by sending a specially crafted link to a user that appears to be a legitimate Jenkins login page but redirects them to a malicious website after they authenticate. This type of attack is primarily used for phishing to steal further credentials or distribute malware by exploiting the user's trust in the Jenkins domain.
Technical details
The Jenkins Bitbucket OAuth Plugin (versions 0.17 and earlier) suffers from an open redirect vulnerability (CWE-601). The plugin fails to restrict the 'redirect' parameter after a successful OAuth login flow, allowing it to point to absolute URLs outside of the Jenkins domain. An unauthenticated remote attacker can craft a URL that, once a victim successfully authenticates via Bitbucket, redirects the victim's browser to an attacker-controlled site. This is typically leveraged in phishing campaigns to give malicious links the appearance of legitimacy. The issue was resolved in version 0.18 by restricting redirects to relative URLs only.
Affected products
- Jenkins Bitbucket OAuth Plugin <= 0.17
Timeline
- 2026-05-27: disclosed
- 2026-05-27: advisory
- 2026-05-27: patched