Which versions of Secure Login 2FA are affected by CVE-2026-12225?

The syracom AG Secure Login 2FA plugin (3.4.0.x) used across our Jira, Confluence, and Bitbucket instances contains a critical vulnerability allowing attackers holding valid first-factor credentials…. A patch is available.

How to fix or mitigate CVE-2026-12225?

Within 24 hours: Audit all instances of syracom AG Secure Login plugin version 3.4.0.x across Jira, Confluence, and Bitbucket; inventory affected users and systems; issue incident communication. Within 7 days: Disable HTTP User-Agent-based mobile app detection in the plugin configuration; deploy Web Application Firewall (WAF) rules blocking requests with 'AtlassianMobileApp' or 'JIRA' in User-Agent headers; enable detailed audit logging for authentication events. Within 30 days: Evaluate replacement 2FA solutions; contact vendor for patch timeline; implement IP-based access restrictions and additional authentication requirements for sensitive operations.

Secure Login 2FA CVE-2026-12225

Q: What is the CVSS score of CVE-2026-12225?

CVE-2026-12225 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-37066 HIGH

Authentication Bypass Using an Alternate Path or Channel (CWE-288)

2026-06-16 SEC-VLab

GHSA-xfw8-8p99-43jw

Atlassian Authentication Bypass Secure Login 2Fa For Jira Secure Login 2Fa For Confluence Secure Login 2Fa For Bitbucket

8.7

CVSS 4.0 · Vendor: SEC-VLab

Severity by source

Vendor (SEC-VLab) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.8 HIGH

Network-reachable HTTP, trivial header injection (AC:L), requires one valid low-priv credential (PR:L), no user interaction; bypassing 2FA on the app yields full C/I/A on the Atlassian instance.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (SEC-VLab).

CVSS VectorVendor: SEC-VLab

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jun 16, 2026 - 13:01 EUVD

Analysis Generated

Jun 16, 2026 - 11:51 vuln.today

CVE Published

Jun 16, 2026 - 11:20 cve.org

HIGH 8.7

DescriptionCVE.org

syracom AG Secure Login (2FA) for Atlassian Jira, Confluence, and Bitbucket 3.4.0.x contains an authentication bypass vulnerability. An attacker with valid credentials for a user account can bypass the two-factor authentication flow by sending HTTP requests with a crafted User-Agent header containing specific strings such as AtlassianMobileApp or JIRA. When such a User-Agent is present, the plugin does not enforce the configured 2FA checks for protected web resources. Successful exploitation allows the attacker to access the affected Atlassian application as the compromised user without completing 2FA. If the compromised account has administrative privileges, the attacker can access administrative functionality and may disable the 2FA plugin or make arbitrary administrative changes. The issue is fixed in version 3.5.0.0.

AnalysisAI

Two-factor authentication bypass in syracom AG Secure Login (2FA) plugin 3.4.0.x for Atlassian Jira, Confluence, and Bitbucket allows an attacker holding valid first-factor credentials to skip the 2FA challenge entirely by injecting strings like 'AtlassianMobileApp' or 'JIRA' into the HTTP User-Agent header. The plugin treats such requests as mobile-app traffic and waives 2FA enforcement on protected web resources, effectively neutralizing the security control the plugin exists to provide. No public exploit identified at time of analysis, but the technique is trivial to reproduce from the public advisory text.

Technical ContextAI

The affected component is a third-party Atlassian Marketplace plugin (cpe:2.3:a:syracom_ag:secure_login_(2fa)_for_jira/confluence/bitbucket) that adds a TOTP/second-factor step to the standard Atlassian login flow. To accommodate Atlassian mobile clients that cannot complete the in-browser 2FA challenge, the plugin inspects the User-Agent string and silently disables the 2FA enforcement filter when known mobile-app substrings are detected. Because the User-Agent header is fully attacker-controlled, this allow-list functions as an alternate authentication path with no cryptographic binding - squarely matching CWE-288 (Authentication Bypass Using an Alternate Path or Channel). The result is that the second factor is, in practice, opt-in by the client.

RemediationAI

Vendor-released patch: upgrade the Secure Login (2FA) plugin to version 3.5.0.0 or later in each affected Atlassian application, per the syracom advisory at https://syracom-bee.atlassian.net/wiki/spaces/SL/pages/4193255427/2026-05-11+-+Secure+Login+security+advisory+-+Broken+Access+Control. If immediate upgrade is not possible, a compensating control is to terminate TLS in front of Atlassian with a reverse proxy (nginx, Apache, F5, Cloudflare, Atlassian Gateway) and either strip or rewrite the User-Agent header on inbound requests, or block requests whose User-Agent contains 'AtlassianMobileApp' or 'JIRA' before they reach the application - note this will break legitimate Atlassian mobile-app users until the patch is applied, so users on iOS/Android Jira and Confluence apps should be warned to use the browser in the interim. As an additional containment step, review audit logs for successful logins that did not produce a corresponding 2FA event since installation of 3.4.0.x, and force a password reset plus session invalidation for any administrator accounts.