What is the CVSS score of CVE-2026-41103?

CVE-2026-41103 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.1%.

Which versions of Microsoft SSO Plugin are affected by CVE-2026-41103?

Microsoft's SAML SSO authentication plugins for Atlassian Jira and Confluence contain a critical authentication bypass (CVE-2026-41103) allowing unauthenticated attackers to impersonate any user and…. A patch is available.

How to fix or mitigate CVE-2026-41103?

Within 24 hours, identify all Jira instances running versions 1.0.0 through 1.3.2 and Confluence instances running versions 1.0.0 through 7.3.x with the Microsoft SAML SSO plugin enabled; create a prioritized patching schedule with production systems first. Within 7 days, deploy the vendor-released patch across all affected environments in a controlled sequence (development, staging, production) and validate that SAML authentication functions correctly post-patch. Within 30 days, review all authentication and access logs from before the patch date for evidence of unauthorized user impersonation or suspicious privilege escalation, reset credentials for all accounts with administrative roles, and complete a post-incident access control audit.

Microsoft SSO Plugin CVE-2026-41103

EUVD-2026-29689 CRITICAL

Incorrect Implementation of Authentication Algorithm (CWE-303)

2026-05-12 microsoft

GHSA-w9j2-m5wx-fqq4

Authentication Bypass Microsoft Atlassian Microsoft Confluence Saml Sso Plugin Microsoft Jira Saml Sso Plugin

9.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

ENISA EUVD

HIGH

qualitative

vuln.today AI

9.1 CRITICAL

Network-reachable SAML authentication bypass needing no privileges or interaction (AV:N/AC:L/PR:N/UI:N); identity spoofing yields high confidentiality and integrity impact but no availability effect.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 21:05 vuln.today

CVE Published

May 12, 2026 - 16:59 nvd

CRITICAL 9.1

DescriptionCVE.org

Incorrect implementation of authentication algorithm in Microsoft SSO Plugin for Jira & Confluence allows an unauthorized attacker to elevate privileges over a network.

AnalysisAI

Authentication bypass in Microsoft's SAML SSO plugins for Atlassian Jira (versions 1.0.0 through 1.3.2) and Confluence (versions 1.0.0 through 7.3.x) allows a remote, unauthenticated attacker to impersonate other users and elevate privileges over the network due to an incorrectly implemented authentication algorithm. Rated CVSS 9.1 with full confidentiality and integrity impact, the flaw is deemed automatable with total technical impact by CISA's SSVC framework, though EPSS remains low (0.12%) and no public exploit has been identified at time of analysis. A vendor patch is available.

Technical ContextAI

The affected components are Microsoft-authored SAML Single Sign-On plugins distributed for the Atlassian Jira and Confluence platforms (CPE: microsoft:microsoft_jira_saml_sso_plugin and microsoft:microsoft_confluence_saml_sso_plugin). SAML SSO relies on the service provider correctly validating cryptographically signed assertions issued by an identity provider to establish user identity and entitlements. The root cause maps to CWE-303 (Incorrect Implementation of Authentication Algorithm), meaning the plugin's routine that verifies the SAML authentication response is flawed - for example failing to properly validate the assertion signature, issuer, audience, or conditions - so that an attacker-supplied or manipulated assertion is accepted as legitimate. Because the plugin sits at the trust boundary for who is authenticated into Jira/Confluence, a defect there directly translates into identity spoofing and privilege elevation.

RemediationAI

Upgrade to the fixed releases: Microsoft JIRA SAML SSO plugin 1.3.3 or later and Microsoft Confluence SAML SSO plugin 7.4.0 or later, which are the first versions outside the vulnerable ranges (Patch available per vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41103). Because this is a network-reachable authentication bypass with no vendor-documented configuration workaround, if immediate patching is not possible consider restricting network access to the Jira/Confluence SSO endpoints to trusted IP ranges or VPN, or temporarily disabling the affected SAML SSO plugin and reverting to Atlassian's native or an alternative vetted authentication mechanism - with the trade-off that this disrupts federated login for legitimate users. After patching, review authentication and admin-access logs for anomalous or unexpected logins that may indicate prior abuse, and consider rotating sessions. Consult the advisories at https://vuldb.com/vuln/363219 and https://nvd.nist.gov/vuln/detail/CVE-2026-41103 for updates.