Atlassian fixes critical Jira authentication bypass vulnerability

Atlassian has published a security advisory to alert that its Jira and Jira Service Management products are affected by a critical authentication bypass vulnerability in Seraph, the company’s web application security framework.

Seraph is used in Jira and Confluence for handling all login and logout requests via a system of pluggable core elements.

Although the vulnerability is in the core of Jira, it affects first and third-party apps that specify “Roles required” at the “Webwork1” action namespace level and do not specify it at an “Action” level.

The two bundled apps affected by the flaw are “Insight – Asset Management” and “Mobile Plugin” for Jira.

If no impacted apps are used in Jira, then the severity of the vulnerability drops down to medium.

As for the Jira Service Management, the fixed versions are 4.13.x >= 4.13.18, 4.20.x >= 4.20.6, and 4.22.0 and later.

Share this article on social media:

Subscribe to Our Newsletter!
Stay on top of cybersecurity risks, evolving threats and industry news.

The Latest Cybersecurity News

From major cyberattacks, newly discovered critical vulnerabilities to recommended best practices, read it here first:

Tell us about your needs.
Get an answer the same business day.

Tell us about your needs.
Get an answer the same business day.

Fill out the form below and get an answer from our experts within 1 business day.

Got an urgent request? Call us at 1-877-805-7475 or Book a meeting.


What happens next:

  • We reach out to learn about your objectives
  • We work together to define your project's scope
  • You get an all-inclusive, no engagement proposal

This field is for validation purposes and should be left unchanged.
Scroll to Top


Enter Your
Corporate Email

This site is registered on as a development site.