CVE-2021-26077

The Atlassian Connect Spring Boot (ACSB) Java Spring Boot package is vulnerable to Broken Authentication in versions 1.1.0 before 2.1.3 and 2.1.4 before 2.1.5 . The root cause is that the software erroneously accepts context JWTs in lifecycle endpoints, such as installation, where only server-to-...

CVE-2021-26074

CVE-2021-26074 affects Atlassian Connect Spring Boot (ACSB) versions 1.1.0 through 2.1.2 (before 2.1.3). The root cause is that ACSB erroneously accepts context JWTs on lifecycle endpoints (e.g., installation) where only server-to-server JWTs should be accepted, enabling an attacker to send authe...