CVE-2026-92138
4.2 MEDIUMPublished 2026-09-16 · Updated 2026-09-18
AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.
NVD description
The OAuth authorization endpoint in Jenkins Bitbucket Server Integration Plugin 6.0.1 and earlier reads the `oauth_callback` URL from the submitted form rather than from the server-side stored request token, allowing attackers to hijack the OAuth flow and obtain an access token on behalf of the victim.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N
Weaknesses
CWE-345
All references
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- MEDIUMCVE-2026-19941
- HIGHCVE-2026-49450PoC
- HIGHCVE-2026-63127PoC
- MEDIUMCVE-2026-67618PoC
- UNSCOREDCVE-2026-73177
- HIGHCVE-2026-73435
- MEDIUMCVE-2026-77955
- MEDIUMCVE-2026-92360PoC
Related by shared AI tags and CWE weakness class. Browse the full archive.