CloudSEK discovered the vulnerability when investigating the compromise of an employee's Jira password by an attacker earlier this month. The attacker used a Jira session cookie from a stolen log, the company concluded. CloudSEK says Atlassian has been told of the problem and is working to solve it. The vulnerability is a known issue, the researchers add. But, they says, most companies worry more about closing other website vulnerabilities — like cross-site scripting — that allow attackers to get security tokens and session cookies. "However," say the researchers, "it is no longer very difficult for threat actors to get their hands on these tokens. With the rise in device compromise campaigns, breaches, and password leaks, cookie theft has become commonplace. And cookies are available for sale, and one can simply search for a company, buy their logs, and find relevant tokens to gain access to their internal systems."