Jenkins Project Jenkins Bitbucket OAuth Plugin

• CVE-2026-48924 Medium 4.3 Jenkins Bitbucket OAuth Plugin 0.17 and earlier does not restrict the redirect URL after login, allowing attackers to perform phishing attacks. 0.2%
• CVE-2023-24427 Critical 9.8 Jenkins Bitbucket OAuth Plugin 0.12 and earlier does not invalidate the previous session on login. 1.1%
• CVE-2023-24428 Medium 5.7 A cross-site request forgery (CSRF) vulnerability in Jenkins Bitbucket OAuth Plugin 0.12 and earlier allows attackers to trick users into logging in to the attacker's account. 0.5%