Security Flaw in Atlassian Products (Jira, Confluence,Trello, BitBucket) Affecting Multiple Companies

CloudSEK reported that Atlassian cloud session cookies remained valid for 30 days and were not invalidated by password changes, enabling attackers who purchase stealer logs and cookies on dark web marketplaces to hijack Jira/Confluence/Bitbucket sessions and bypass 2FA; the report provides PoC steps, marketplace evidence (thousands of compromised machines and hundreds of Atlassian cookies), affected scope, common stealer families, and notes Atlassian has patched the behavior.