2026-05-11 - Secure Login security advisory - Broken Access Control
Overview
App name | Secure Login (2FA) |
|---|---|
Advisory Release Date | May 11, 2026 |
Severity | HIGH |
Affected Versions |
|
Fixed Versions | 3.5.0.0 |
Summary of Vulnerability
Secure Login (2FA) adds two-factor authentication to the login process. The app contains a broken access control vulnerability that may allow an attacker to bypass the two-factor authentication process. Successful exploitation requires valid credentials of a target user account.
Such credentials could, for example, be obtained through password leakage, credential reuse, or phishing. If an attacker is able to authenticate with valid username and password, the second authentication factor may be bypassed under certain conditions.
Workaround
Update to the patched version 3.5.0.0 immediately.
Fix
The vulnerability has been fixed with version 3.5.0.0 of Secure Login.
Authentication behavior by version
In Secure Login version 3.4.0.x, the 2FA protection provided by Secure Login did not consistently apply to Atlassian’s mobile app login flows. While browser-based authentication was protected by Secure Login, mobile app authentication could bypass the 2FA challenge.
Secure Login version 3.5.0.0 changes this behavior. Mobile app authentication is now blocked in Jira version >= 10.2.x and Confluence version >= 9.1.0 by default unless a dedicated legacy compatibility flag is enabled by an administrator.
When the legacy flag is not enabled, users cannot authenticate through Atlassian mobile apps. When the legacy flag is enabled, mobile app authentication remains possible, but Secure Login 2FA is enforced for the login flow.
This change prevents mobile app authentication from acting as an unintended bypass for 2FA enforcement. Customers using Atlassian mobile apps should review their Data Center JVM system properties configuration after upgrading. If mobile app access is explicitly required, administrators need to enable the legacy authentication flag.
For details regarding app versions and intended behavior see this troubleshooting article.
Support
If you have any questions or concerns regarding this advisory, please raise a support request at our Service Desk.
Credits
syracom AG would like to thank Timo Müller and Laurentius von Oppenkowski (discovery, analysis, coordination) from the SEC Consult Vulnerability Lab (https://www.sec-consult.com/) for their responsible disclosure of the identified vulnerability and their constructive collaboration in remediating them.