syracom Secure Login (2FA) for Confluence allows 2FA bypass via spoofed User-Agent
Summary
| CVE | CVE-2026-12225 |
|---|---|
| State | PUBLISHED |
| Assigner | SEC-VLab |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-06-16 12:16:26 UTC |
| Updated | 2026-06-21 09:16:24 UTC |
| Description | syracom AG Secure Login (2FA) for Atlassian Jira, Confluence, and Bitbucket 3.4.0.x contains an authentication bypass vulnerability. An attacker with valid credentials for a user account can bypass the two-factor authentication flow by sending HTTP requests with a crafted User-Agent header containing specific strings such as AtlassianMobileApp or JIRA. When such a User-Agent is present, the plugin does not enforce the configured 2FA checks for protected web resources. Successful exploitation allows the attacker to access the affected Atlassian application as the compromised user without completing 2FA. If the compromised account has administrative privileges, the attacker can access administrative functionality and may disable the 2FA plugin or make arbitrary administrative changes. The issue is fixed in version 3.5.0.0. |
Risk And Classification
Primary CVSS: v4.0 8.7 HIGH from 551230f0-3615-47bd-b7cc-93e92e730bbf
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS: 0.003560000 probability, percentile 0.272950000 (date 2026-06-20)
Problem Types: CWE-288 | CWE-288 CWE-288 Authentication bypass using an alternate path or channel
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 4.0 | 551230f0-3615-47bd-b7cc-93e92e730bbf | Secondary | 8.7 | HIGH | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/C... |
| 4.0 | CNA | CVSS | 8.7 | HIGH | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
CVSS v4.0 Breakdown
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Syracom AG | Secure Login 2FA For Jira | affected 3.4.0.0 3.5.0.0 custom | Not specified |
| CNA | Syracom AG | Secure Login 2FA For Confluence | affected 3.4.0.0 3.5.0.0 custom | Not specified |
| CNA | Syracom AG | Secure Login 2FA For Bitbucket | affected 3.4.0.0 custom | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| r.sec-consult.com/syracom | 551230f0-3615-47bd-b7cc-93e92e730bbf | r.sec-consult.com | |
| seclists.org/fulldisclosure/2026/Jun/16 | af854a3a-2127-422b-91ae-364da2661108 | seclists.org | |
| marketplace.atlassian.com/apps/1214491/secure-login-2fa-for-confluence | 551230f0-3615-47bd-b7cc-93e92e730bbf | marketplace.atlassian.com | |
| syracom-bee.atlassian.net/wiki/spaces/SL/pages/4230217729/Mobile+app+login+does+not+wor... | 551230f0-3615-47bd-b7cc-93e92e730bbf | syracom-bee.atlassian.net | |
| syracom-bee.atlassian.net/wiki/spaces/SL/pages/4193255427/2026-05-11+-+Secure+Login+sec... | 551230f0-3615-47bd-b7cc-93e92e730bbf | syracom-bee.atlassian.net | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: Laurentius von Oppenkowski, SEC Consult Vulnerability Lab (en)
CNA: Timo Müller, SEC Consult Vulnerability Lab (en)
Additional Advisory Data
Solutions
CNA: Upgrade Secure Login (2FA) for Jira, Confluence, and Bitbucket to version 3.5.0.0 or later.
Workarounds
CNA: No workaround is required. The vendor provides a fixed version 3.5.0.0, which should be installed immediately.