# CVE-2026-48924: Jenkins Bitbucket OAuth Plugin open redirect

Source: https://junglewise.ai/threats/cve-2026-48924-jenkins-bitbucket-oauth-plugin-open-redirect  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-27. Updated: 2026-07-01  
License: CC BY 4.0 with a link back

CVE-2026-48924 · Severity: medium · CVSS 4.3 · Published 2026-05-27

The Jenkins Bitbucket OAuth Plugin, which allows users to log into Jenkins using their Bitbucket accounts, contains a flaw that fails to validate redirection URLs after a user logs in. An attacker could exploit this by sending a specially crafted link to a user that appears to be a legitimate Jenkins login page but redirects them to a malicious website after they authenticate. This type of attack is primarily used for phishing to steal further credentials or distribute malware by exploiting the user's trust in the Jenkins domain.

Technologies: [org.jenkins-ci.plugins:bitbucket-oauth (Maven)](https://junglewise.ai/threats/technologies/org-jenkins-ci-plugins-bitbucket-oauth). Vendors: [Jenkins](https://junglewise.ai/threats/vendors/jenkins), [Maven](https://junglewise.ai/threats/vendors/maven).

## Quick answers

**Is CVE-2026-48924 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-48924 being exploited in the wild.

**How severe is CVE-2026-48924?** Medium severity, with a CVSS score of 4.3, published 27 May 2026.

**Which products and versions are affected?** Jenkins Bitbucket OAuth Plugin <= 0.17, 0.17 and earlier; org.jenkins-ci.plugins:bitbucket-oauth (Maven) <= 0.17, ECOSYSTEM:introduced=0,fixed=0.18.

**Is there a fix for CVE-2026-48924?** Yes. org.jenkins-ci.plugins:bitbucket-oauth (Maven): upgrade to 0.18 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-48924 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-48924?** Check whether you run Jenkins Bitbucket OAuth Plugin or org.jenkins-ci.plugins:bitbucket-oauth (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- org.jenkins-ci.plugins:bitbucket-oauth (Maven): upgrade to 0.18 or later

  ```sh
  # set org.jenkins-ci.plugins:bitbucket-oauth to 0.18 in your pom.xml or build.gradle
  ```


## Technical details

The Jenkins Bitbucket OAuth Plugin (versions 0.17 and earlier) suffers from an open redirect vulnerability (CWE-601). The plugin fails to restrict the 'redirect' parameter after a successful OAuth login flow, allowing it to point to absolute URLs outside of the Jenkins domain. An unauthenticated remote attacker can craft a URL that, once a victim successfully authenticates via Bitbucket, redirects the victim's browser to an attacker-controlled site. This is typically leveraged in phishing campaigns to give malicious links the appearance of legitimacy. The issue was resolved in version 0.18 by restricting redirects to relative URLs only.

## Affected products

- Jenkins Bitbucket OAuth Plugin <= 0.17

## Identifiers

- CVE-2026-48924
- GHSA-r8fj-rff6-f7h5

## Timeline

- 2026-05-27: disclosed
- 2026-05-27: advisory
- 2026-05-27: patched

## References

- [https://www.jenkins.io/security/advisory/2026-05-27/](https://www.jenkins.io/security/advisory/2026-05-27/)

## Related threats

- [Session fixation vulnerability in Jenkins Bitbucket OAuth Plugin](https://junglewise.ai/threats/cve-2023-24427-session-fixation-vulnerability-in-jenkins-bitbucket-oauth-plugin)
- [Cross-site request forgery vulnerability in Jenkins Bitbucket OAuth Plugin](https://junglewise.ai/threats/cve-2023-24428-cross-site-request-forgery-vulnerability-in-jenkins-bitbucket)
- [Jenkins Bitbucket OAuth Plugin contains Insufficiently Protected Credentials](https://junglewise.ai/threats/cve-2019-10460-jenkins-bitbucket-oauth-plugin-contains-insufficiently-protected)