CVE-2026-12225 is an authentication bypass vulnerability in syracom AG Secure Login (2FA) for Atlassian Jira, Confluence, and Bitbucket version 3.4.0.0. The vulnerability arises because the plugin does not enforce two-factor authentication checks when HTTP requests include a User-Agent header with certain strings (e.g., AtlassianMobileApp or JIRA). An attacker with valid credentials can exploit this to bypass 2FA and gain unauthorized access to protected resources. Administrative accounts exploited in this manner can be used to disable the 2FA plugin or make arbitrary administrative changes. The vulnerability is classified under CWE-288 (Authentication Bypass Using an Alternate Path or Channel) and has a CVSS 4.0 score of 8.7 (high severity). The issue is resolved in version 3.5.0.0.

Successful exploitation allows attackers who already have valid user credentials to bypass the two-factor authentication mechanism, gaining full access to the affected Atlassian application as the compromised user. If the compromised user has administrative privileges, the attacker can access administrative functions, potentially disabling the 2FA plugin or making arbitrary administrative changes, significantly increasing the risk of further compromise or persistent control.

A fix is available in syracom AG Secure Login (2FA) version 3.5.0.0. Users of version 3.4.0.0 should upgrade to 3.5.0.0 or later to remediate this vulnerability. No other vendor advisory or temporary mitigation is provided, so upgrading is the recommended action.