CVE-2026-12225

Vulnerability

The vulnerability exists in syracom AG's Secure Login (2FA) plugin for Atlassian Jira, Confluence, and Bitbucket, versions 3.4.0.x [1][2]. When an HTTP request is sent with a User-Agent header containing strings such as AtlassianMobileApp or JIRA, the plugin's code does not enforce configured two-factor authentication checks, allowing access to protected web resources without completing the second factor [1][2]. The plugin treats such requests as mobile app authentication and skips 2FA enforcement.

Exploitation

An attacker needs valid credentials for a target user account. They authenticate with username and password, then send subsequent requests with a crafted User-Agent header containing the bypass string (e.g., AtlassianMobileApp). The plugin does not require the second factor for these requests, granting access as the authenticated user [1][2]. No additional privileges or user interaction are required beyond the initial credential compromise.

Impact

Successful exploitation allows the attacker to bypass 2FA and access the Atlassian application as the compromised user. If that user has administrative privileges, the attacker can access admin functionality and potentially disable the 2FA plugin or make arbitrary administrative changes [1]. The core compromise is authentication bypass leading to privilege escalation in the context of the user's role.

Mitigation

The issue is fixed in version 3.5.0.0, released May 11, 2026 [2][3]. Administrators should update immediately. For environments where mobile app login is blocked by default after the fix (Jira >=10.2.x, Confluence >=9.1.0), a legacy flag -Datlassian.authentication.legacy.mode=true can be set, but only with proper understanding that 2FA is enforced in that mode [2]. No workaround other than upgrading is recommended; the vulnerable 3.4.0.x series should be considered end-of-life.