EUVD-2026-29689
GHSA-w9j2-m5wx-fqq4
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach Jira/Confluence SSO endpoint
-
DeliveryCraft forged SAML assertion
-
ExploitBypass flawed signature/identity check
-
ExecutionAssume privileged user session
-
ImpactAccess or alter application data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication algorithm review
|
| Exploitation Conditions | Exploitation requires that the target Jira or Confluence instance has the vulnerable Microsoft SAML SSO plugin installed and enabled (JIRA plugin <1.3.3 or Confluence plugin <7.4.0) and that its SSO login endpoint is reachable by the attacker over the network. Per CVSS AV:N/AC:L/PR:N/UI:N, no authentication, no user interaction, and no special privileges are needed once SAML SSO is in use. The principal limiting factor is deployment scope: only instances actually configured with these specific Microsoft SAML SSO add-ons are affected - organizations using Atlassian native auth or a different SSO provider are not exposed. Exact technical prerequisites (e.g., which assertion field is mis-validated) are not detailed in the available data. |
| Impact | The signals are mixed but lean toward genuine priority for affected deployments. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates a low-complexity, network-reachable attack needing no authentication or user interaction, and SSVC rates the technical impact as total and the flaw as automatable - consistent with a reliable authentication-bypass primitive. Against that, EPSS is only 0.12% (30th percentile) and SSVC exploitation is 'none', with no KEV listing and no public exploit identified at time of analysis, suggesting no observed in-the-wild activity yet. The low EPSS most likely reflects the plugins' relatively narrow install base rather than difficulty of exploitation, so organizations that DO run these plugins should treat this as high priority despite the modest probability score. Note A:N - this is an integrity/confidentiality (identity spoofing) issue, not a denial-of-service. |
| Exploit ScenarioDerived | An attacker who can reach the Jira or Confluence SAML login endpoint over the network crafts or manipulates a SAML authentication response that the flawed verification logic wrongly accepts, causing the plugin to authenticate the attacker as an arbitrary or privileged user. With that spoofed session the attacker gains administrative access to the wiki or issue-tracker and its data. No public exploit code has been identified at time of analysis, but the low complexity and automatable nature make weaponization plausible if details surface. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 23, 2026
Authentication bypass in Microsoft's SAML SSO plugins for Atlassian Jira (versions 1.0.0 through 1.3.2) and Confluence (versions 1.0.0 through 7.3.x) allows a remote, unauthenticated attacker to impersonate other users and elevate privileges over the network due to an incorrectly implemented authentication algorithm. Rated CVSS 9.1 with full confidentiality and integrity impact, the flaw is deemed automatable with total technical impact by CISA's SSVC framework, though EPSS remains low (0.12%) and no public exploit has been identified at time of analysis. A vendor patch is available.
RemediationAI
Upgrade to the fixed releases: Microsoft JIRA SAML SSO plugin 1.3.3 or later and Microsoft Confluence SAML SSO plugin 7.4.0 or later, which are the first versions outside the vulnerable ranges (Patch available per vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41103). Because this is a network-reachable authentication bypass with no vendor-documented configuration workaround, if immediate patching is not possible consider restricting network access to the Jira/Confluence SSO endpoints to trusted IP ranges or VPN, or temporarily disabling the affected SAML SSO plugin and reverting to Atlassian's native or an alternative vetted authentication mechanism - with the trade-off that this disrupts federated login for legitimate users. After patching, review authentication and admin-access logs for anomalous or unexpected logins that may indicate prior abuse, and consider rotating sessions. Consult the advisories at https://vuldb.com/vuln/363219 and https://nvd.nist.gov/vuln/detail/CVE-2026-41103 for updates.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected components are Microsoft-authored SAML Single Sign-On plugins distributed for the Atlassian Jira and Confluence platforms (CPE: microsoft:microsoft_jira_saml_sso_plugin and microsoft:microsoft_confluence_saml_sso_plugin). SAML SSO relies on the service provider correctly validating cryptographically signed assertions issued by an identity provider to establish user identity and entitlements. The root cause maps to CWE-303 (Incorrect Implementation of Authentication Algorithm), meaning the plugin's routine that verifies the SAML authentication response is flawed - for example failing to properly validate the assertion signature, issuer, audience, or conditions - so that an attacker-supplied or manipulated assertion is accepted as legitimate. Because the plugin sits at the trust boundary for who is authenticated into Jira/Confluence, a defect there directly translates into identity spoofing and privilege elevation.
Know when Microsoft Confluence Saml Sso Plugin gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Network-reachable SAML authentication bypass needing no privileges or interaction (AV:N/AC:L/PR:N/UI:N); identity spoofing yields high confidentiality and integrity impact but no availability effect.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
DescriptionCVE.org
Incorrect implementation of authentication algorithm in Microsoft SSO Plugin for Jira & Confluence allows an unauthorized attacker to elevate privileges over a network.
Executive ViewAI
Microsoft's SAML SSO authentication plugins for Atlassian Jira and Confluence contain a critical authentication bypass (CVE-2026-41103) allowing unauthenticated attackers to impersonate any user and assume administrative privileges. Organizations using these platforms face exposure of sensitive project data, operational information, and system access without requiring valid credentials. Immediate patching is mandatory to prevent unauthorized access and potential compromise of business-critical collaboration infrastructure.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB