{"id":"CVE-2026-92138","title":"The OAuth authorization endpoint in Jenkins Bitbucket Server Integration Plugin 6.0.1 and earlier reads the `oauth_callback` URL from the submitted form rather than from the server-side stored request token, allowing attackers to hijack …","summary":"The OAuth authorization endpoint in Jenkins Bitbucket Server Integration Plugin 6.0.1 and earlier reads the `oauth_callback` URL from the submitted form rather than from the server-side stored request token, allowing attackers to hijack …","severity":"medium","cvss":4.2,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N","cwe":["CWE-345"],"vendor":"Jenkins Project","product":"Jenkins Bitbucket Server Integration Plugin","affected":["jenkins_bitbucket_server_integration_plugin <= 6.0.1"],"published":"2026-09-16","updated":"2026-09-18","sourceUpdated":"2026-09-18T13:46:13.937","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-92138","references":[{"url":"https://www.jenkins.io/security/advisory/2026-09-16/#SECURITY-3778","label":"jenkinsci-cert@googlegroups.com"}],"tags":["nvd","cve.org"],"epss":0.00105,"epssPercentile":0.01218,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-09-16T18:37:06.859556Z"},"ingestedAt":"2026-09-16T14:57:28.024Z","slug":"CVE-2026-92138","body":"## Overview\n\nThe OAuth authorization endpoint in Jenkins Bitbucket Server Integration Plugin 6.0.1 and earlier reads the `oauth_callback` URL from the submitted form rather than from the server-side stored request token, allowing attackers to hijack the OAuth flow and obtain an access token on behalf of the victim.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":23,"depthScoreParts":{"impact":23.1,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":205678,"id":"CVE-2026-92138","ts":1789585397579,"field":"cvss","old":null,"new":"4.2"},{"seq":205677,"id":"CVE-2026-92138","ts":1789585397579,"field":"severity","old":"none","new":"medium"}]}