TI-2021-08029 Aliases CVE-2021-26077 GHSA-2x7v-w2mv-f3rx

Improper authentication in Atlassian Connect Spring Boot

MEDIUM 41CWE-287Published 2021-05-09 · Updated 2025-02-12

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: High · Low · Low
Fix status: Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and GitHub. Impact type from CWE-287.

Summary

Broken Authentication in Atlassian Connect Spring Boot (ACSB) in version 1.1.0 before 2.1.3 and from version 2.1.4 before 2.1.5: Atlassian Connect Spring Boot is a Java Spring Boot package for building Atlassian Connect apps. Authentication between Atlassian products and the Atlassian Connect Spring Boot app occurs with a server-to-server JWT or a context JWT. Atlassian Connect Spring Boot versions 1.1.0 before 2.1.3 and versions 2.1.4 before 2.1.5 erroneously accept context JWTs in lifecycle endpoints (such as installation) where only server-to-server JWTs should be accepted, permitting an attacker to send authenticated re-installation events to an app.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00951 61st percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed Atlassian Connect Spring Boot (ACSB) (Atlassian): 2.1.3, 2.1.5com.atlassian.connect:atlassian-connect-spring-boot (Maven): 2.1.3, 2.1.5

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Atlassian	Atlassian Connect Spring Boot (ACSB)	1.1.0 and later; before 2.1.3; 2.1.4 and later; before 2.1.5	2.1.3, 2.1.5	Patch available	CNA
—	com.atlassian.connect:atlassian-connect-spring-boot (Maven)	1.1.0 to before 2.1.3	2.1.3	Patch available	GHSA-2x7v-w2mv-f3rx
—	com.atlassian.connect:atlassian-connect-spring-boot (Maven)	2.1.4 to before 2.1.5	2.1.5	Patch available	GHSA-2x7v-w2mv-f3rx

Atlassian Connect Spring Boot (ACSB) VendorAtlassian Affected 1.1.0 and later; before 2.1.3; 2.1.4 and later; before 2.1.5 Fixed in 2.1.3, 2.1.5 Patch available CNA
com.atlassian.connect:atlassian-connect-spring-boot (Maven) Vendor— Affected 1.1.0 to before 2.1.3 Fixed in 2.1.3 Patch available GHSA-2x7v-w2mv-f3rx
com.atlassian.connect:atlassian-connect-spring-boot (Maven) Vendor— Affected 2.1.4 to before 2.1.5 Fixed in 2.1.5 Patch available GHSA-2x7v-w2mv-f3rx

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:atlassian:connect_spring_boot::::::::	1.1.0 to before 2.1.3; 2.1.4 to before 2.1.5	Vulnerable	Atlassian

cpe:2.3:a:atlassian:connect_spring_boot:*:*:*:*:*:*:*:* Versions 1.1.0 to before 2.1.3; 2.1.4 to before 2.1.5 Vulnerable ·Atlassian

Remediation

Fix · CNA Atlassian Connect Spring Boot (ACSB) (Atlassian) Fixed in 2.1.3, 2.1.5
Fix · GHSA-2x7v-w2mv-f3rx com.atlassian.connect:atlassian-connect-spring-boot (Maven) Fixed in 2.1.3 Advisory →
Fix · GHSA-2x7v-w2mv-f3rx com.atlassian.connect:atlassian-connect-spring-boot (Maven) Fixed in 2.1.5 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2021-26077
2026-10-03 Alias added: GHSA-2x7v-w2mv-f3rx

References

Exploit 1

https://community.developer.atlassian.com/t/action-required-atlassian-connect-vulnerability-allows-bypass-of-app-qsh-verification-via-context-jwts/47072

Advisory 2

TI-2021-08026 Improper authentication in Atlassian Connect Spring Boot CVSS 3.1MEDIUM 6.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences