CVE-2026-92138

The OAuth authorization endpoint in Jenkins Bitbucket Server Integration Plugin 6.0.1 and earlier reads the oauthcallback URL from the submitted form rather than from the server-side stored request token, allowing attackers to hijack the OAuth flow and obtain an access token on behalf of the vict...

EUVD-2026-80762

The OAuth authorization endpoint in Jenkins Bitbucket Server Integration Plugin 6.0.1 and earlier reads the oauthcallback URL from the submitted form rather than from the server-side stored request token, allowing attackers to hijack the OAuth flow and obtain an access token on behalf of the vict...

CVE-2026-92138

The OAuth authorization endpoint in Jenkins Bitbucket Server Integration Plugin 6.0.1 and earlier reads the oauthcallback URL from the submitted form rather than from the server-side stored request token, allowing attackers to hijack the OAuth flow and obtain an access token on behalf of the vict...

CVE-2026-92138

The Jenkins Bitbucket Server Integration Plugin (atlassian-bitbucket-server-integration) versions 6.0.1 and earlier is vulnerable to an OAuth access token hijacking flaw. The OAuth authorization endpoint incorrectly reads the oauth_callback URL from the submitted form instead of using the server-...

CVE-2026-92138

The OAuth authorization endpoint in Jenkins Bitbucket Server Integration Plugin 6.0.1 and earlier reads the oauthcallback URL from the submitted form rather than from the server-side stored request token, allowing attackers to hijack the OAuth flow and obtain an access token on behalf of the vict...

CVE-2026-92138: Insufficient Verification of Data Authenticity

The OAuth authorization endpoint in Jenkins Bitbucket Server Integration Plugin 6.0.1 and earlier reads the oauthcallback URL from the submitted form rather than from the server-side stored request token, allowing attackers to hijack the OAuth flow and obtain an access token on behalf of the vict...

OAuth access token hijacking via callback URL manipulation in atlassian-bitbucket-server-integration

atlassian-bitbucket-server-integration implements an OAuth provider for Bitbucket Server. The OAuth authorization endpoint in atlassian-bitbucket-server-integration 6.0.1 and earlier reads the oauthcallback URL from the submitted form rather than from the server-side stored request token. An...

CVE-2026-52841: Authorization Bypass Through User-Controlled Key

Easy!Appointments is a self hosted appointment scheduler. In versions prior to 1.6.0, Google::oauth at application/controllers/Google.php:278 stores its URL-supplied providerid in the session, and oauthcallback saves the issued Google OAuth token against that row without checking the caller owns...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the WP RESTful plugin 0.1 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 oauthcallback parameter to htmlapiauthorize.php or the 2 oauthtokentemp or 3 oauthcallbacktemp parameter to...

CVE-2014-4595

Multiple cross-site scripting XSS vulnerabilities in the WP RESTful plugin 0.1 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 oauthcallback parameter to htmlapiauthorize.php or the 2 oauthtokentemp or 3 oauthcallbacktemp parameter to...

CVE-2014-4595: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in the WP RESTful plugin 0.1 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 oauthcallback parameter to htmlapiauthorize.php or the 2 oauthtokentemp or 3 oauthcallbacktemp parameter to...