CVE-2026-12225 is an authentication bypass vulnerability in syracom AG Secure Login (2FA) for Atlassian Jira, Confluence, and Bitbucket version 3.4.0.0. The vulnerability arises because the plugin does not enforce two-factor authentication checks when the HTTP User-Agent header contains certain strings such as AtlassianMobileApp or JIRA. An attacker with valid credentials can exploit this to bypass 2FA and gain unauthorized access to protected resources. Administrative accounts compromised this way can be used to disable the 2FA plugin or make arbitrary administrative changes. The issue is resolved in version 3.5.0.0.

Successful exploitation allows an attacker who already has valid user credentials to bypass the two-factor authentication mechanism, gaining full access to the affected Atlassian application as the targeted user. If the compromised user has administrative privileges, the attacker can access administrative functions, including disabling the 2FA plugin or making arbitrary administrative changes, significantly increasing the risk to the affected environment.

A fix is available in syracom AG Secure Login (2FA) version 3.5.0.0. Users of version 3.4.0.0 should upgrade to version 3.5.0.0 or later to remediate this vulnerability. No other mitigation guidance is provided in the vendor advisory.