CVE-2026-41103 - Vulnerability Details - OpenCVE

Incorrect implementation of authentication algorithm in Microsoft SSO Plugin for Jira & Confluence allows an unauthorized attacker to elevate privileges over a network.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact total

Vendors	Products
Microsoft	Confluence Saml Sso Plugin Jira Saml Sso Plugin

No data.

No data.

References

Link	Providers
https://www.spirityenterprise.com/managed-detection-response-microsoft
https://www.spirityenterprise.com/virtual-ciso
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41103

History

Tue, 12 May 2026 19:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Tue, 12 May 2026 17:30:00 +0000

Type	Values Removed	Values Added
Description		Incorrect implementation of authentication algorithm in Microsoft SSO Plugin for Jira & Confluence allows an unauthorized attacker to elevate privileges over a network.
Title		Microsoft SSO Plugin for Jira & Confluence Elevation of Privilege Vulnerability
First Time appeared		Microsoft Microsoft confluence Saml Sso Plugin Microsoft jira Saml Sso Plugin
Weaknesses		CWE-303
CPEs		cpe:2.3:a:microsoft:confluence_saml_sso_plugin:::::::: cpe:2.3:a:microsoft:jira_saml_sso_plugin::::::::
Vendors & Products		Microsoft Microsoft confluence Saml Sso Plugin Microsoft jira Saml Sso Plugin
References		https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41103
Metrics		cvssV3_1 `{'score': 9.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C'}`

MITRE

Status: PUBLISHED

Assigner: microsoft

Published: 2026-05-12T16:59:32.156Z

Updated: 2026-05-12T18:57:47.959Z

Reserved: 2026-04-16T19:12:36.195Z

Link: CVE-2026-41103

Vulnrichment

Updated: 2026-05-12T18:57:42.904Z

NVD

Status : Received

Published: 2026-05-12T18:17:21.887

Modified: 2026-05-12T18:17:21.887

Link: CVE-2026-41103

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-41103", "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "state": "PUBLISHED", "assignerShortName": "microsoft", "dateReserved": "2026-04-16T19:12:36.195Z", "datePublished": "2026-05-12T16:59:32.156Z", "dateUpdated": "2026-05-12T18:57:47.959Z"}, "containers": {"cna": {"title": "Microsoft SSO Plugin for Jira & Confluence Elevation of Privilege Vulnerability", "datePublic": "2026-05-12T14:00:00.000Z", "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:jira_saml_sso_plugin:*:*:*:*:*:*:*:*", "versionStartIncluding": "1.0.0", "versionEndExcluding": "1.3.3"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:confluence_saml_sso_plugin:*:*:*:*:*:*:*:*", "versionStartIncluding": "1.0.0", "versionEndExcluding": "7.4.0"}]}]}], "affected": [{"vendor": "Microsoft", "product": "Microsoft Confluence SAML SSO plugin", "versions": [{"version": "1.0.0", "lessThan": "7.4.0", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Microsoft JIRA SAML SSO plugin", "versions": [{"version": "1.0.0", "lessThan": "1.3.3", "versionType": "custom", "status": "affected"}]}], "descriptions": [{"value": "Incorrect implementation of authentication algorithm in Microsoft SSO Plugin for Jira & Confluence allows an unauthorized attacker to elevate privileges over a network.", "lang": "en-US"}], "problemTypes": [{"descriptions": [{"description": "CWE-303: Incorrect Implementation of Authentication Algorithm", "lang": "en-US", "type": "CWE", "cweId": "CWE-303"}]}], "providerMetadata": {"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "shortName": "microsoft", "dateUpdated": "2026-05-12T17:54:28.077Z"}, "references": [{"name": "Microsoft SSO Plugin for Jira & Confluence Elevation of Privilege Vulnerability", "tags": ["vendor-advisory", "patch"], "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41103"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en-US", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "baseSeverity": "CRITICAL", "baseScore": 9.1, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C"}}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-12T18:57:33.740459Z", "id": "CVE-2026-41103", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-12T18:57:47.959Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-41103", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-05-12T18:57:33.740459Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-12T18:57:42.904Z"}}], "cna": {"title": "Microsoft SSO Plugin for Jira & Confluence Elevation of Privilege Vulnerability", "metrics": [{"format": "CVSS", "cvssV3_1": {"version": "3.1", "baseScore": 9.1, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C"}, "scenarios": [{"lang": "en-US", "value": "GENERAL"}]}], "affected": [{"vendor": "Microsoft", "product": "Microsoft Confluence SAML SSO plugin", "versions": [{"status": "affected", "version": "1.0.0", "lessThan": "7.4.0", "versionType": "custom"}]}, {"vendor": "Microsoft", "product": "Microsoft JIRA SAML SSO plugin", "versions": [{"status": "affected", "version": "1.0.0", "lessThan": "1.3.3", "versionType": "custom"}]}], "datePublic": "2026-05-12T14:00:00.000Z", "references": [{"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41103", "name": "Microsoft SSO Plugin for Jira & Confluence Elevation of Privilege Vulnerability", "tags": ["vendor-advisory", "patch"]}], "descriptions": [{"lang": "en-US", "value": "Incorrect implementation of authentication algorithm in Microsoft SSO Plugin for Jira & Confluence allows an unauthorized attacker to elevate privileges over a network."}], "problemTypes": [{"descriptions": [{"lang": "en-US", "type": "CWE", "cweId": "CWE-303", "description": "CWE-303: Incorrect Implementation of Authentication Algorithm"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:microsoft:jira_saml_sso_plugin:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "1.3.3", "versionStartIncluding": "1.0.0"}, {"criteria": "cpe:2.3:a:microsoft:confluence_saml_sso_plugin:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.4.0", "versionStartIncluding": "1.0.0"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "shortName": "microsoft", "dateUpdated": "2026-05-12T17:54:28.077Z"}}}, "cveMetadata": {"cveId": "CVE-2026-41103", "state": "PUBLISHED", "dateUpdated": "2026-05-12T18:57:47.959Z", "dateReserved": "2026-04-16T19:12:36.195Z", "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "datePublished": "2026-05-12T16:59:32.156Z", "assignerShortName": "microsoft"}, "dataVersion": "5.2"}