The Jenkins Bitbucket OAuth Plugin versions 0.17 and earlier contain a vulnerability that fails to properly restrict the redirect URL post-login. This allows an attacker to manipulate the redirect destination, potentially leading users to phishing sites. No CVSS score or detailed exploit information is provided, and no patch or official remediation guidance is currently available.

The vulnerability enables attackers to perform phishing attacks by redirecting authenticated users to arbitrary URLs after login. This could lead to credential theft or other social engineering attacks. There is no indication of direct code execution or privilege escalation from the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when using the affected plugin versions and consider restricting plugin usage or monitoring for suspicious redirect behavior.