Broken Access Control in syracom AG Secure Login (2FA) for Atlassian Products (CVE-2026-12225)

Broken Access Control in syracom AG Secure Login (2FA) for Atlassian Jira / Confluence / Bitbucket Vulnerability Overview Vulnerability Name: Broken Access Control CVE ID: CVE-2026-12225 Description: The syracom AG Secure Login (2FA) plugin contains a vulnerability that allows attackers to bypass Multi-Factor Authentication (MFA). Attackers can bypass the 2FA flow by using a specific user agent (such as the Confluence mobile application user agent), thereby gaining access to the entire page and all settings, including the ability to make administrative changes. Impact Scope Affected Products: syracom AG Secure Login (2FA) for Atlassian Jira / Confluence / Bitbucket Affected Versions: 3.4.0.x Fixed Versions: 3.5.0.0 Remediation Recommendation: Install the patch immediately and conduct a comprehensive security audit to identify and address potential security issues. Exploit Code Exploitation Steps 1. Initial Login: The attacker logs into the application using the victim's username and password. Due to the specific user agent, the 2FA page is not displayed to the user. 2. View 2FA Key: The attacker can view the current user's 2FA key by accessing a specific URL. 3. Access Admin Pages: The attacker can access admin pages and the Confluence WebSudo page. 4. Disable 2FA Plugin: The attacker can disable the 2FA plugin via the administrative API. Tested Versions Tested Version: 3.4.0.1 Affected Versions: - Secure Login (2FA) - Jira = 3.4.0.x - Secure Login (2FA) - Confluence = 3.4.0.x - Secure Login (2FA) - Bitbucket = 3.4.0.0 Vendor Contact Timeline 2026-03-10: Vendor contacted 2026-03-10: Vendor confirmed receipt and began investigation of the vulnerability 2026-04-01: Status inquiry 2026-04-01: Vendor stated that a fix is being developed 2026-04-21: Vendor informed that the fix is still in development

Goal Reached Thanks to every supporter — we hit 100%!

Broken Access Control in syracom AG Secure Login (2FA) for Atlassian Products (CVE-2026-12225)