CVE-2021-26073
HIGHatlassian-connect-express 3.0.2-6.5.9 - Improper Authentication via Context JWT Acceptance
Title source: llmDescription
Broken Authentication in Atlassian Connect Express (ACE) from version 3.0.2 before version 6.6.0: Atlassian Connect Express is a Node.js package for building Atlassian Connect apps. Authentication between Atlassian products and the Atlassian Connect Express app occurs with a server-to-server JWT or a context JWT. Atlassian Connect Express versions from 3.0.2 before 6.6.0 erroneously accept context JWTs in lifecycle endpoints (such as installation) where only server-to-server JWTs should be accepted, permitting an attacker to send authenticated re-installation events to an app.
References (3)
Core 3
Core References
Vendor Advisory x_refsource_misc
https://confluence.atlassian.com/pages/viewpage.action?pageId=1051986099
Various Sources x_refsource_misc
https://community.developer.atlassian.com/t/action-required-atlassian-connect-vulnerability-a%5B%E2%80%A6%5Dypass-of-app-qsh-verification-via-context-jwts/47072
Third Party Advisory x_refsource_confirm
https://security.netapp.com/advisory/ntap-20210604-0004/
Scores
CVSS v3
7.7
EPSS
0.0034
EPSS Percentile
57.0%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
partial
Details
CWE
CWE-287
Status
published
Products (2)
atlassian/connect_express
3.0.2 - 6.6.0
npm/atlassian-connect-express
3.0.2 - 6.6.0npm
Published
Apr 16, 2021
Tracked Since
Feb 18, 2026