GO-2026-6483 Mattermost doesn't authenticate Atlassian Connect installed callbacks, allowing a remote unauthenticated attacker to inject a rogue sharedSecret in github.com/mattermost/mattermost-server

Mattermost doesn't authenticate Atlassian Connect installed callbacks, allowing a remote unauthenticated attacker to inject a rogue sharedSecret in github.com/mattermost/mattermost-server...

Atlassian Connect Descriptor - Detect

The app descriptor is a JSON file atlassian-connect. json that describes the app to the Atlassian application. The descriptor includes general information for the app, as well as the modules that the app wants to use or extend. !/usr/bin/env python3 -- coding: utf-8 -- """The app descriptor is a...

Mattermost doesn't authenticate Atlassian Connect installed callbacks, allowing a remote unauthenticated attacker to inject a rogue sharedSecret

Mattermost versions 11.7.x = 11.7.0, 11.6.x = 11.6.2, 11.5.x = 11.5.5, 10.11.x = 10.11.17 fail to authenticate Atlassian Connect installed callbacks, allowing a remote unauthenticated attacker to inject a rogue sharedSecret and disrupt the Jira integration via POST to /ac/installed during the...

GHSA-JQGV-39MG-7C2R Mattermost doesn't authenticate Atlassian Connect installed callbacks, allowing a remote unauthenticated attacker to inject a rogue sharedSecret

Mattermost versions 11.7.x = 11.7.0, 11.6.x = 11.6.2, 11.5.x = 11.5.5, 10.11.x = 10.11.17 fail to authenticate Atlassian Connect installed callbacks, allowing a remote unauthenticated attacker to inject a rogue sharedSecret and disrupt the Jira integration via POST to /ac/installed during the...

CVE-2026-6673

Mattermost versions 11.7.x = 11.7.0, 11.6.x = 11.6.2, 11.5.x = 11.5.5, 10.11.x = 10.11.17 fail to authenticate Atlassian Connect installed callbacks, allowing a remote unauthenticated attacker to inject a rogue sharedSecret and disrupt the Jira integration via POST to /ac/installed during the...

CVE-2026-6673 Mattermost Jira plugin had unauthenticated {{/ac/installed}} lifecycle callback during pending Jira Cloud install

Mattermost versions 11.7.x = 11.7.0, 11.6.x = 11.6.2, 11.5.x = 11.5.5, 10.11.x = 10.11.17 fail to authenticate Atlassian Connect installed callbacks, allowing a remote unauthenticated attacker to inject a rogue sharedSecret and disrupt the Jira integration via POST to /ac/installed during the...

EUVD-2026-38249

Mattermost versions 11.7.x = 11.7.0, 11.6.x = 11.6.2, 11.5.x = 11.5.5, 10.11.x = 10.11.17 fail to authenticate Atlassian Connect installed callbacks, allowing a remote unauthenticated attacker to inject a rogue sharedSecret and disrupt the Jira integration via POST to /ac/installed during the...

CVE-2026-6673: Missing Authentication for Critical Function

Mattermost versions 11.7.x = 11.7.0, 11.6.x = 11.6.2, 11.5.x = 11.5.5, 10.11.x = 10.11.17 fail to authenticate Atlassian Connect installed callbacks, allowing a remote unauthenticated attacker to inject a rogue sharedSecret and disrupt the Jira integration via POST to /ac/installed during the...

PT-2026-51316

Name of the Vulnerable Software and Affected Versions Mattermost version 11.7.0 Mattermost version 11.6.2 Mattermost version 11.5.5 Mattermost version 10.11.17 Description Remote unauthenticated attackers can inject a rogue sharedSecret and disrupt the Jira integration. This occurs during the...

EUVD-2021-12896

Malware in sbrugna...

EUVD-2021-1047

Malware in sbrugna...

EUVD-2021-1244

Malware in sbrugna...

Atlassian Connect Spring Boot Auth Bypass

The vulnerability of the development environment for web applications built with Atlassian Connect Spring Boot is related to deficiencies in the authentication process. Exploiting this vulnerability allows a malicious actor to bypass the authentication process...

com.atlassian.connect:atlassian-connect-spring-boot-core (>=2.1.8, <=2.2.1), com.atlassian.connect:atlassian-connect-spring-boot-jwt (>=2.1.8, <=2.2.1) +131 more potentially affected by CVE-2025-53864 via com.nimbusds:nimbus-jose-jwt (8.20.2)

com.nimbusds:nimbus-jose-jwt MAVEN version 8.20.2 is affected by a known vulnerability. The following packages have a transitive dependency on com.nimbusds:nimbus-jose-jwt and may be impacted: - com.atlassian.connect:atlassian-connect-spring-boot-core =2.1.8, =2.1.8, =2.1.8, =3.4.0, =3.3.0,...

com.atlassian.connect:atlassian-connect-spring-boot-core (>=0.9.0-alpha, <=1.3.6), com.atlassian.connect:atlassian-connect-spring-boot-jwt (>=0.9.0-alpha, <=1.3.6) +3 more potentially affected by CVE-2025-53864 via com.nimbusds:nimbus-jose-jwt (3.6)

com.nimbusds:nimbus-jose-jwt MAVEN version 3.6 is affected by a known vulnerability. The following packages have a transitive dependency on com.nimbusds:nimbus-jose-jwt and may be impacted: - com.atlassian.connect:atlassian-connect-spring-boot-core =0.9.0-alpha, =0.9.0-alpha, =0.9.0-alpha,...

com.github.allantl:atlassian-connect-http4s_2.12 (>=0.1.0, <=0.1.2), com.github.allantl:jira4s_2.12 (0.2.0) +291 more potentially affected by CVE-2025-53864 via com.nimbusds:nimbus-jose-jwt (7.1)

com.nimbusds:nimbus-jose-jwt MAVEN version 7.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.nimbusds:nimbus-jose-jwt and may be impacted: - com.github.allantl:atlassian-connect-http4s2.12 =0.1.0, =1.4, =0.29.0, =0.29.0, =0.29.0, =0.29.0, =0.29.0...

com.atlassian.connect:atlassian-connect-spring-boot-core (>=0.9.0-alpha, <=1.3.6), com.atlassian.connect:atlassian-connect-spring-boot-jwt (>=0.9.0-alpha, <=1.3.6) +3 more potentially affected by CVE-2023-52428 via com.nimbusds:nimbus-jose-jwt (3.6)

com.nimbusds:nimbus-jose-jwt MAVEN version 3.6 is affected by a known vulnerability. The following packages have a transitive dependency on com.nimbusds:nimbus-jose-jwt and may be impacted: - com.atlassian.connect:atlassian-connect-spring-boot-core =0.9.0-alpha, =0.9.0-alpha, =0.9.0-alpha,...

cn.kerrysmec.mpaas:unicorn (>=0.1.0, <=0.1.2), com.atlassian.connect:atlassian-connect-spring-boot-core (>=2.0.0-beta-1, <=2.0.0) +57 more potentially affected by CVE-2023-52428 via com.nimbusds:nimbus-jose-jwt (7.3)

com.nimbusds:nimbus-jose-jwt MAVEN version 7.3 is affected by a known vulnerability. The following packages have a transitive dependency on com.nimbusds:nimbus-jose-jwt and may be impacted: - cn.kerrysmec.mpaas:unicorn =0.1.0, =2.0.0-beta-1, =2.0.0-beta-1, =2.0.0-beta-1, =0.0.6, =0.0.6, =1.18.8,...

@nexus-switchboard/nexus-conn-jira (>=0.1.0, <=0.2.2), @nexus-switchboard/nexus-mod-service (>=0.4.1, <=0.6.3) +1 more potentially affected by CVE-2021-26073 via atlassian-connect-express (>=3.5.2, <=4.4.1)

atlassian-connect-express NPM version =3.5.2, =0.1.0, =0.4.1, =0.0.1, =2.0.5 Source cves: CVE-2021-26073 Source advisory: GHSA-4V96-M8XV-X83V...

@nexus-switchboard/nexus-conn-jira (>=0.1.0, <=0.2.2), @nexus-switchboard/nexus-mod-service (>=0.4.1, <=0.6.3) +1 more potentially affected by CVE-2021-26073 via atlassian-connect-express (>=3.5.2, <=4.4.1)

atlassian-connect-express NPM version =3.5.2, =0.1.0, =0.4.1, =0.0.1, =2.0.5 Source cves: CVE-2021-26073 Source advisory: OSV:GHSA-4V96-M8XV-X83V...