CVE-2026-12225: syracom Secure Login (2FA) for Confluence allows 2FA bypass via spoofed User-Agent

Synopsis

This is an authentication bypass vulnerability in syracom AG Secure Login (2FA) for Atlassian Jira, Confluence, and Bitbucket versions in the 3.4.0.x range. An attacker who already holds valid credentials for any account can skip the two-factor authentication step entirely by sending HTTP requests with a crafted User-Agent header containing strings like AtlassianMobileApp or JIRA, which the plugin incorrectly treats as trusted mobile clients exempt from 2FA enforcement. Successful exploitation grants full authenticated access to the Atlassian application without 2FA, and if the compromised account is an administrator, the attacker can disable the 2FA plugin or make arbitrary administrative changes. A patched-image rebuild at version 3.5.0.0 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Atlassian application over the network to send the crafted HTTP request; any internet-exposed or intranet-accessible instance is in scope.

• AuthenticationRequired

  The attacker needs a valid low-privilege account on the Atlassian instance; no admin rights are required to bypass 2FA, though higher-privilege accounts amplify impact.

• Victim interactionNot required

  No user action or social engineering is needed; the attacker sends crafted requests directly to the application without any victim participation.

• Attack complexityDetail

  Exploitation is straightforward and condition-free: the attacker simply includes a specific string in the User-Agent header, with no race conditions or memory-layout dependencies to manage.

Blast Radius

• Attacker gains full authenticated session access to Jira, Confluence, or Bitbucket as the credential-holder, bypassing the 2FA control entirely.
• Reads all content and data accessible to the compromised account, including confidential pages, repositories, and project data.
• Writes or modifies content, tickets, repository commits, and configuration items within the permissions of the compromised account.
• If the compromised account holds administrator privileges, the attacker can disable the 2FA plugin, create new admin accounts, or make arbitrary platform-wide configuration changes.