Mobile+app+login+does+not+work+with+Secure+Login

syracom-bee.atlassian.net • June 17, 2026

Users are unable to log in to Atlassian products using the official Atlassian mobile apps (Jira or Confluence). Login attempts might fail during authentication. This behavior is typically observed after upgrading Jira, Confluence or Secure Login (or changing authentication-related settings) and can affect all mobile devices.

Secure Login distinguishes between browser-based authentication and mobile app authentication. Mobile apps use a dedicated authentication experience that is handled differently from standard web logins.

Depending on the Data Center version and configuration:

Mobile authentication may be intentionally restricted by your administrator

Legacy mobile login support may be disabled

As a result, mobile login attempts can fail even though browser-based login continues to work as expected.

Use the tables below to identify the most common reasons why login via Atlassian mobile apps does not work when Secure Login is installed.

Vulnerable Secure Login Version ! Update to the patched version 3.5.0.0 immediately!

Yes (by bypassing two-factor authentication)

Vulnerable Secure Login Version ! Update to the patched version 3.5.0.0 immediately!

Yes (needs admin action)

Mobile app login is blocked by default since it is not compatible with the New login experience by Atlassian. Mobile app login can be (re-)enabled by setting the JVM system property for legacy login mode to true:

Vulnerable Secure Login Version ! Update to the patched version 3.5.0.0 immediately!

Yes (by bypassing two-factor authentication)

Vulnerable Secure Login Version ! Update to the patched version 3.5.0.0 immediately!

Yes (needs admin action)

Mobile app login is disabled by default since it is not compatible with the New login experience by Atlassian. Mobile app login can be (re-)enabled by setting the JVM system property for legacy login mode to true:

There is no Atlassian Bitbucket mobile app.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Vulnerability in syracom AG 2FA Plugin for Atlassian Products The Secure Login (2FA) plugin for Atlassian Jira, Confluence, and Bitbucket has a serious broken access control vulnerability. This flaw allows attackers with valid user credentials to bypass multi-factor authentication (MFA) by manipulating the user agent in HTTP requests. Successful exploitation can lead to unauthorized access to administrative settings and the ability to disable the 2FA feature entirely. The vulnerability is particularly dangerous as it affects all user roles, not just administrators. Affected systems include Confluence instances using the syracom AG plugin. The vendor has released a patch that should be applied immediately to mitigate the risk. Security professionals are advised to conduct a thorough review of the product for additional vulnerabilities. The vulnerability underscores the importance of robust security measures in software plugins. 3 sources 73

Mobile+app+login+does+not+work+with+Secure+Login

The full story

Extracted Entities

CWE Weaknesses (1)

Platforms (3)