The Jenkins Bitbucket Server Integration Plugin version 6.0.1 and earlier contains a security flaw in its OAuth authorization endpoint. Specifically, the endpoint reads the oauth_callback URL from the client-submitted form rather than from the server-side stored request token. This improper validation enables an attacker to hijack the OAuth authorization flow, potentially obtaining an access token that grants access to the victim's account or resources.

An attacker exploiting this vulnerability can hijack the OAuth flow and obtain an access token on behalf of the victim. This could lead to unauthorized access to resources or actions performed with the victim's privileges within the Jenkins Bitbucket Server Integration context.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution with OAuth authorization flows and consider restricting plugin usage or OAuth access where possible.