Jenkins Bitbucket OAuth Plugin 0.12 and earlier does not invalidate the previous session on login.
CWE-384, CWE-384