CVE-2026-92138

MediumCVSS 4.2/10Last modified Sep 18, 2026

Description

The OAuth authorization endpoint in Jenkins Bitbucket Server Integration Plugin 6.0.1 and earlier reads the `oauth_callback` URL from the submitted form rather than from the server-side stored request token, allowing attackers to hijack the OAuth flow and obtain an access token on behalf of the victim.

Metrics

CVSS 3.1 4.2/10CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-345

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
Jenkins Project	Jenkins Bitbucket Server Integration Plugin	<= 6.0.1

References

https://www.jenkins.io/security/advisory/2026-09-16/#SECURITY-3778

Timeline

Published: Sep 16, 2026
Last modified: Sep 18, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-921396.5Jenkins Bitbucket Push and Pull Request Plugin 4.0.1 and earlier trusts values provided in the webhook payload, including certain URLs, and CVE-2026-92144.5Insufficient input validation vulnerability in the NETGEAR R7000 models allows authenticated administrators connected to the local network CVE-2026-921406.8Jenkins Gitee Plugin 1301.v8957053c7902 and earlier does not escape the sender name from Gitee push webhook payloads in build causes, result CVE-2026-921414.3Jenkins Keycloak Authentication Plugin 2.4.1 and earlier does not restrict the redirect URL after login, allowing attackers to perform phish CVE-2026-921428.8Apache Karaf exposes a JMX MBeanServer guarded by KarafMBeanServerGuard, which enforces role-based access control (RBAC) on MBean operations CVE-2026-921447.2The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting vi CVE-2026-92156.7A cross site request forgery (CSRF) vulnerability in the listed NETGEAR models allows an attacker who can leverage social engineering techni CVE-2026-921507.5F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.2.0,CVE-2026-921517.5F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.2.0,CVE-2026-921529.3F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. From 4.1.0 unti CVE-2026-921537.1F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.3.0,CVE-2026-921548.1F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.2.0,