CVE-2026-92138

Executive Summary

CVE-2026-92138 is an OAuth callback manipulation vulnerability (CWE-345: Insufficient Verification of Data Authenticity) in the Jenkins Bitbucket Server Integration Plugin, affecting version 6.0.1 and earlier. The plugin's OAuth authorization endpoint reads the oauth_callback URL from a client-submitted form instead of from the server-side stored request token, letting an attacker redirect the OAuth authorization code to a destination they control and thereby obtain an access token on behalf of an authenticated victim. Impact is scoped to confidentiality and integrity of the victim user's Bitbucket access (CVSS 4.2, AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N) and requires user interaction; no public exploit, PoC, or Nuclei template currently exists.

Technical Analysis

The vulnerability class here is insufficient verification of data authenticity during an OAuth 2.0 authorization flow. In a correctly-implemented OAuth client, the redirect_uri/callback value used to deliver the authorization code to the client is bound to the original authorization request — typically via a server-side-stored request token (or an equivalent state record) created at the time the flow began. That binding is what prevents a malicious party from substituting an alternate callback destination mid-flow.

Per the NVD description, the Jenkins Bitbucket Server Integration Plugin 6.0.1 and earlier deviates from that model at its OAuth authorization endpoint: when the authorization form is submitted, the endpoint reads the oauth_callback value from the submitted form rather than from the server-side stored request token. Two distinct trust failures result:

1. The callback destination is attacker-influenceable. Because the endpoint trusts a value supplied in the request instead of a value it previously recorded for that flow, a party who can influence the submitted form data can change where the authorization code is ultimately returned.
2. The callback is not bound to the request that initiated the flow. The server has no opportunity to reject a callback that does not match the one it stored, because it never consults the stored value — the authenticity of the callback is never verified against a trusted source of record.

The technical consequence is an OAuth flow hijack: the authorization code issued for the victim's Bitbucket authorization is delivered to a callback the attacker influenced, and the attacker exchanges it for an access token on behalf of the victim — as stated directly in the description. The attack surface is the Jenkins web UI's OAuth authorization endpoint exposed through the plugin, reachable over the network (AV:N), but exploitation requires the victim to participate in the flow (UI:R) and a non-trivial set of adversarial conditions (AC:H).

Explicitly unavailable detail: The NVD description does not name the endpoint path, the form field beyond oauth_callback, the servlet/class implementing the flow, or the token-exchange logic. No parameter names, file paths, or function names beyond oauth_callback should be assumed; any such specificity would be fabrication. The description also does not state whether the flow is the classic authorization-code flow or a variant, only that an oauth_callback value is submitted via a form and that the result is an access token for the victim.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class (OAuth callback manipulation) and the NVD description text only. No specific function names, endpoint paths, or code patterns are asserted beyond oauth_callback.

1) Reconnaissance / target identification. The attacker identifies a Jenkins instance running the Bitbucket Server Integration Plugin at version 6.0.1 or earlier — for example via the Jenkins web UI version fingerprint or plugin listing, or via an internet-facing or otherwise reachable Jenkins dashboard. The attacker must also have some ability to influence the victim's navigation into the OAuth authorization flow (e.g., directing the victim to initiate it, or a position enabling interaction with the submitted form data). This is consistent with the AC:H rating: the flow requires both a victim session and attacker control over the submitted oauth_callback.

2) Triggering the flaw class. The victim is induced to (or otherwise does) initiate the Bitbucket Server OAuth authorization flow against the vulnerable Jenkins plugin. When the authorization form is submitted, the attacker supplies or manipulates the oauth_callback value contained in the submitted form. Because the endpoint reads the callback from the form rather than from the server-side stored request token, the server uses the attacker-influenced destination instead of the one it recorded when the flow began.

3) Delivery / execution at the vulnerability-class level. The authorization is completed for the victim, and the resulting authorization code is directed to the attacker-influenced callback destination rather than the legitimate one. The attacker captures the code at that destination and exchanges it for an access token. The NVD description explicitly states this results in the attacker obtaining "an access token on behalf of the victim." No payload bytes, exploit script, or HTTP request body should be assumed beyond the described oauth_callback form value substitution.

4) Post-exploitation impact. The attacker now holds an access token that grants the same Bitbucket-side access as the victim. This maps to the CVSS subscores: limited confidentiality impact (C:L) and limited integrity impact (I:L) within the scope of the victim's authorized access (S:U), with no availability impact (A:N). The attacker's access is bounded by what the victim's OAuth grant permits — i.e., the blast radius is the victim's Bitbucket authorization scope, not the Jenkins controller itself, and not other users (S:U).

Impact Assessment

• Business impact: An attacker who successfully hijacks the OAuth flow gains a Bitbucket access token bound to the victim's authorization. Such a token can expose source code, repositories, and metadata the victim can access, and may permit actions the token's scope allows — a direct source-code and IP confidentiality concern. The explicitly limited CVSS impact ratings (C:L/I:L) reflect that the grant is scoped and bounded; the outcome is not full Jenkins compromise.
• Affected systems: Jenkins controllers with the Bitbucket Server Integration Plugin at 6.0.1 and earlier. The CVSS vector AV:N/AC:H/PR:N/UI:R/S:U indicates a network-reachable attack that does not require prior privileges (PR:N), requires victim interaction (UI:R), is comparatively difficult to pull off (AC:H), and is scoped to the victim (S:U). No availability impact.
• Blast radius: Scoped to the victim user's Bitbucket authorization (S:U). Because PR:N and UI:R, the attacker does not need an account but does need a victim to complete the flow.
• Exploit maturity: None. No public PoC, no Nuclei template, no exploit code, no CISA KEV listing, and no EPSS score (not yet scored by FIRST.org). Detection therefore depends on behavioral rules (below) rather than known-signature matching.

Detection Guidance

The detection strategies below target the observable behavior described: a callback value supplied via the submitted authorization form (oauth_callback) that diverges from the server-stored request token, and authorization-code delivery to an unexpected callback host/domain. Signatures are necessarily heuristic because no exploit artifact exists publicly.

Sigma Rule

title: Jenkins Bitbucket Server Integration Plugin OAuth Callback Parameter Tampering
id: 8f4c2b1a-0d3e-4a7b-9c21-5e6f7a8b9c0d
status: experimental
description: Detects requests submitted to the Jenkins Bitbucket Server Integration plugin OAuth authorization endpoint that carry an oauth_callback form value, indicative of the CVE-2026-92138 flow-hijack attempt.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-92138
author: valtersit.com
date: 2026-01-01
logsource:
  category: webserver
detection:
  selection_method:
    cs-method:
      - 'POST'
      - 'GET'
  selection_uri:
    cs-uri-stem|contains: 'bitbucket'
  selection_callback:
    cs-uri-query|contains: 'oauth_callback'
  condition: selection_method and selection_uri and selection_callback
falsepositives:
  - Legitimate completion of the OAuth authorization form by an authorized user
  - Security testing of the plugin
level: medium
tags:
  - attack.t1185
  - cve.2026-92138

YARA Rule

rule CVE_2026_92138_Jenkins_Bitbucket_OAUTH_CALLBACK_TAMPER
{
    meta:
        author = "valtersit.com"
        description = "Detects references to oauth_callback form handling in Jenkins Bitbucket Server Integration plugin artifacts (CVE-2026-92138)"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-92138"
        date = "2026-01-01"
    strings:
        $s1 = "oauth_callback" ascii wide
        $s2 = "oauth_callback" nocase
        $b1 = "Bitbucket Server Integration" ascii wide
        $p1 = "bitbucket-server-integration" ascii wide
    condition:
        uint32(0) == 0x504b0304 and
        any of ($s*) and
        any of ($b*, $p1)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-92138 Jenkins Bitbucket OAuth oauth_callback Manipulation Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"bitbucket"; nocase; http.client_body; content:"oauth_callback"; nocase; reference:cve,2026-92138; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-92138; classtype:attempted-user; sid:202692138; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=10m
  [network where event.action == "network" and
     url.path : "*bitbucket*" and
     (url.query contains "oauth_callback" or http.request.body.content contains "oauth_callback")]

Splunk SPL Query

index=web OR index=proxy
| search (uri_path="*bitbucket*" OR url="*bitbucket*")
| search (uri_query="*oauth_callback*" OR form_data="*oauth_callback*" OR http_body="*oauth_callback*")
| stats count min(_time) as first_seen max(_time) as last_seen
        values(src_ip) as source_ips
        values(uri_path) as uri_paths
        values(oauth_callback) as callbacks
        by dest_host, user
| where count >= 1
| convert ctime(first_seen) ctime(last_seen)
| sort - count
| table dest_host, user, count, source_ips, callbacks, first_seen, last_seen

Wazuh OSSEC Rule

<group name="web,jenkins,cve-2026-92138,">
  <rule id="2026921" level="8">
    <decoded_as>json</decoded_as>
    <field name="url">\.*bitbucket\.*</field>
    <match>oauth_callback</match>
    <description>CVE-2026-92138: Potential Jenkins Bitbucket Server Integration OAuth callback manipulation - oauth_callback present in request to Bitbucket endpoint</description>
    <mitre>
      <id>T1185</id>
    </mitre>
    <group>oauth_flow_hijack,pci_dss_6.5,gdpr_iv_35.7.d,</group>
  </rule>

  <rule id="2026922" level="12">
    <if_sid>2026921</if_sid>
    <field name="id">\.*oauth_callback=.*</field>
    <regex>oauth_callback=https?%3A%2F%2F</regex>
    <description>CVE-2026-92138: Suspicious absolute-URL oauth_callback value submitted to Jenkins Bitbucket OAuth endpoint - possible flow hijack</description>
    <mitre>
      <id>T1185</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, workaround, or affected-version advisory was supplied in the intelligence data.

1) Immediate mitigations

• Restrict network exposure of the Jenkins controller: do not expose it directly to the internet; place it behind an authenticated reverse proxy or VPN.
• Temporarily disable or remove the Bitbucket Server Integration Plugin if the OAuth integration is not actively required. If it must remain, treat the OAuth flow as high-risk and monitor for oauth_callback tampering per the detection rules above.
• Reduce reliance on the plugin's OAuth-based Bitbucket integration where an alternative (e.g., a properly scoped token with minimal permissions) is feasible.
• User-side awareness: caution users against completing OAuth authorization flows initiated from unsolicited links while the vulnerability is unpatched.

2) Patch/upgrade steps

• No patched version is identified in the provided data. Monitor the Jenkins security advisories and the plugin's release notes for a fixed version above 6.0.1.
• Once a fix is released, upgrade the Bitbucket Server Integration Plugin to the fixed version, then review Bitbucket OAuth grants and invalidate any tokens that may have been issued to unknown callback destinations.
• Because the root cause is reading oauth_callback from the submitted form rather than from the server-side stored request token, the correct fix binds the callback to the stored request token; validate the vendor fix implements that binding before relying on it.

3) Long-term hardening

• Enforce strict redirect-URI allow-listing for all OAuth integrations and bind callback values to server-side-stored state.
• Apply least privilege to Jenkins service accounts and Bitbucket OAuth scopes.
• Maintain an inventory of Jenkins plugins and their versions; subscribe to Jenkins security advisories to catch plugin-level fixes quickly.
• Log and alert on OAuth callback anomalies as standing detections, not just during this CVE's lifetime.

References

• NVD — CVE-2026-92138: https://nvd.nist.gov/vuln/detail/CVE-2026-92138
• CWE-345 — Insufficient Verification of Data Authenticity: https://cwe.mitre.org/data/definitions/345.html
• Jenkins Security Advisories (monitor for the fix): https://www.jenkins.io/security/advisories/
• Jenkins Bitbucket Server Integration Plugin page (verify current version): https://plugins.jenkins.io/bitbucket-server-integration/
• MITRE ATT&CK — T1185 Browser Session Hijacking: https://attack.mitre.org/techniques/T1185/

Exploit/KEV status: No public PoC, no Nuclei template, no exploit code, and no CISA KEV listing as of this report. No known threat actor campaign or exploit-in-the-wild evidence was provided in the intelligence data; none should be assumed. EPSS is not yet scored by FIRST.org — do not treat any EPSS value as established.