CVE-2021-26073

Broken Authentication in Atlassian Connect Express

7.7 HighFix available

Broken Authentication in Atlassian Connect Express (ACE) from version 3.0.2 before version 6.6.0: Atlassian Connect Express is a Node.js package for building Atlassian Connect apps. Authentication between Atlassian products and the Atlassian Connect Express app occurs with a server-to-server JWT or a context JWT. Atlassian Connect Express versions from 3.0.2 before 6.6.0 erroneously accept context JWTs in lifecycle endpoints (such as installation) where only server-to-server JWTs should be accepted, permitting an attacker to send authenticated re-installation events to an app.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: High
Availability: None

Exploit likelihood

0.95%Up 0.3 points since Apr 16, 2021

What each source reports

NVD Score used 7.7

Record: CVE-2021-26073
CVSS 3.1: 7.7 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N
CVSS 2.0: 4.0 MediumAV:N/AC:L/Au:S/C:N/I:P/A:N
Weakness: CWE-287
Updated: 2026-11-02

CVE List 7.7

Record: CVE-2021-26073
CVSS 3.1: 7.7 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N
Weakness: CWE-287
Updated: 2026-11-02

EUVDEUVD-2021-12896 7.7

Record: EUVD-2021-12896
CVSS 3.1: 7.7 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N
Updated: 2026-11-03

GitHub AdvisoriesGHSA-4v96-m8xv-x83v 7.7

Broken Authentication in Atlassian Connect Express

Broken Authentication in Atlassian Connect Express (ACE) from version 3.0.2 before version 6.6.0: Atlassian Connect Express is a Node.js package for building Atlassian Connect apps. Authentication between Atlassian products and the Atlassian Connect Express app occurs with a server-to-server JWT or a context JWT. Atlassian Connect Express versions between 3.0.2 - 6.5.0 erroneously accept context JWTs in lifecycle endpoints (such as installation) where only server-to-server JWTs should be accepted, permitting an attacker to send authenticated re-installation events to an app.

Record: GHSA-4v96-m8xv-x83v
CVSS 3.1: 7.7 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N
Weakness: CWE-287, CWE-863
Updated: 2026-11-02

OSVGHSA-4v96-m8xv-x83v 7.7

Broken Authentication in Atlassian Connect Express

Broken Authentication in Atlassian Connect Express (ACE) from version 3.0.2 before version 6.6.0: Atlassian Connect Express is a Node.js package for building Atlassian Connect apps. Authentication between Atlassian products and the Atlassian Connect Express app occurs with a server-to-server JWT or a context JWT. Atlassian Connect Express versions between 3.0.2 - 6.5.0 erroneously accept context JWTs in lifecycle endpoints (such as installation) where only server-to-server JWTs should be accepted, permitting an attacker to send authenticated re-installation events to an app.

Record: GHSA-4v96-m8xv-x83v
CVSS 3.1: 7.7 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N
Weakness: CWE-287, CWE-863
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`atlassian-connect-express` npm	3.0.2 up to 6.6.0	6.6.0

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases, published	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-26073 is a high vulnerability (CVSS 7.7) in Atlassian Connect Express (ace), published April 16, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.95%, the 61st percentile. Fixed in atlassian-connect-express 6.6.0.