CVE-2016-6668

The Atlassian Hipchat Integration Plugin for Bitbucket Server 6.26.0 before 6.27.5, 6.28.0 before 7.3.7, and 7.4.0 before 7.8.17; Confluence HipChat plugin 6.26.0 before 7.8.17; and HipChat for JIRA plugin 6.26.0 before 7.8.17 allows remote attackers to obtain the secret key for communicating with HipChat instances by reading unspecified pages.

• CWE-200

• http://packetstormsecurity.com/files/139004/Atlassian-HipChat-Secret-Key-Disclosure.htmlThird Party Advisory, VDB Entry
• http://www.securityfocus.com/archive/1/539530/100/0/threadedBroken Link, Third Party Advisory, VDB Entry
• http://www.securityfocus.com/bid/93159Broken Link, Third Party Advisory, VDB Entry
• https://confluence.atlassian.com/bitbucketserver/bitbucket-server-security-advisory-2016-09-21-840698321.htmlVendor Advisory
• https://confluence.atlassian.com/doc/confluence-security-advisory-2016-09-21-849052104.htmlVendor Advisory
• https://confluence.atlassian.com/jira/jira-and-hipchat-for-jira-plugin-security-advisory-2016-09-21-849052099.htmlVendor Advisory
• http://packetstormsecurity.com/files/139004/Atlassian-HipChat-Secret-Key-Disclosure.htmlThird Party Advisory, VDB Entry
• http://www.securityfocus.com/archive/1/539530/100/0/threadedBroken Link, Third Party Advisory, VDB Entry
• http://www.securityfocus.com/bid/93159Broken Link, Third Party Advisory, VDB Entry
• https://confluence.atlassian.com/bitbucketserver/bitbucket-server-security-advisory-2016-09-21-840698321.htmlVendor Advisory
• https://confluence.atlassian.com/doc/confluence-security-advisory-2016-09-21-849052104.htmlVendor Advisory
• https://confluence.atlassian.com/jira/jira-and-hipchat-for-jira-plugin-security-advisory-2016-09-21-849052099.htmlVendor Advisory

Published

Jan 23, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2016-6659Cloud Foundry before 248; UAA 2.x before 2.7.4.12, 3.x befor…
• CVE-2016-6660Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2016-6662Oracle MySQL through 5.5.52, 5.6.x through 5.6.33, and 5.7.x…
• CVE-2016-6663Race condition in Oracle MySQL before 5.5.52, 5.6.x before 5…
• CVE-2016-6664mysqld_safe in Oracle MySQL through 5.5.51, 5.6.x through 5.…7
• CVE-2016-6667NetApp OnCommand Unified Manager for Clustered Data ONTAP 6.…
• CVE-2016-6669Buffer overflow in the Authentication, Authorization and Acc…
• CVE-2016-6670Huawei S7700, S9300, S9700, and S12700 devices with software…
• CVE-2016-6671The raw_decode function in libavcodec/rawdec.c in FFmpeg bef…
• CVE-2016-6672The Synaptics touchscreen driver in Android before 2016-10-0…
• CVE-2016-6673The NVIDIA camera driver in Android before 2016-10-05 on Nex…
• CVE-2016-6674system_server in Android before 2016-10-05 on Nexus devices …