Issue Summary

Jira Cloud — Incoming Mail Server OAuth re-authorization silently rebinds to the browser's active account without validating against the configured mailbox

Steps to Reproduce

1. In Jira Cloud, navigate to Settings → System → Incoming Mail and configure one or more mail handlers pointing to shared service account mailboxes using OAuth authentication against a single Mail Server entry.

1. Allow the OAuth token on that Mail Server to approach its expiration period (~6 months for Google OAuth tokens). Jira will display a re-authorization banner in the admin area.

1. As a Jira App admin who has a personal Google/Microsoft account actively signed into the browser (not in an incognito window), click the re-authorization banner or navigate to the Incoming Mail configuration page.

1. Observe that the OAuth flow completes — either silently (if the browser has an active SSO session) or by prompting the admin to sign in with their personal account.

1. Return to Settings → System → Incoming Mail and inspect the Mail Server configuration.

Expected Results

The re-authorization flow should either:

• Validate that the account being authorized matches the mailbox already configured on the Mail Server and warn or block if there is a mismatch, or

• Require the admin to explicitly confirm the account being used before completing the OAuth binding.

All mail handlers linked to the Mail Server should continue polling the originally configured shared mailboxes without interruption.

Actual Results

The Mail Server's OAuth credential is silently rebound to whichever account is active in the browser at the time of re-authorization. Because the OAuth identity controls which mailbox is actually polled, all handlers sharing that Mail Server entry are now polling the wrong mailbox — with no warning, no confirmation prompt, and no audit log entry recording the change.

When multiple mail handlers reference the same Mail Server configuration entry, they are all affected simultaneously by a single re-authorization event.

No exception is thrown. The re-authorization completes silently, with no errors, warnings, or audit records.

Workaround

o restore the correct configuration after an unintended rebind:

1. Open an incognito/private browser window.

1. Sign into the Jira instance in that window.

1. Navigate to Settings → System → Incoming Mail and open the affected Mail Server.

1. Click Edit → Re-authorize.

1. When redirected to the email provider's sign-in page, authenticate with the correct service account (the shared mailbox originally configured).

1. Confirm the correct email address is now displayed on the Mail Server configuration.

To prevent recurrence, always use an incognito window or a dedicated browser profile when managing incoming mail OAuth, ensuring only the intended service account is signed into the email provider at the time of re-authorization.

Note: This behavior was previously raised in https://jira.atlassian.com/browse/JRACLOUD-84145, which requested credential validation during re-authorization. That ticket was closed as "Timed out" in December 2025 without resolution.