CVE-2026-48924: Medium severity Jenkins Bitbucket OAuth Plugin vulnerability
Published May 27, 2026
·Updated
Jenkins Bitbucket OAuth Plugin 0.17 and earlier does not restrict the redirect URL after login, allowing attackers to perform phishing attacks.
Affected Software
2 affected components
Jenkins Bitbucket OAuth Plugin<=0.17
Jenkins Bitbucket Oauth Jenkins<=0.17
Event History
May 27, 2026
CVE Published
via MITRE·02:13 PM
Data Sourced
via MITRE·02:13 PM
Description
Data Sourced
via NVD·03:16 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2026-48924?
CVE-2026-48924 has a medium severity rating of 4.3 according to CVSS 3.1.
2
What does CVE-2026-48924 affect?
CVE-2026-48924 affects the Jenkins Bitbucket OAuth Plugin version 0.17 and earlier.
3
What is the main risk associated with CVE-2026-48924?
The main risk associated with CVE-2026-48924 is the potential for attackers to conduct phishing attacks by exploiting unrestricted redirect URLs after login.
4
How do I fix CVE-2026-48924?
To fix CVE-2026-48924, update the Jenkins Bitbucket OAuth Plugin to a version later than 0.17.
5
What type of attack is facilitated by CVE-2026-48924?
CVE-2026-48924 facilitates phishing attacks due to the lack of redirect URL restrictions.