JetBrains YouTrack CVE-2026-100260

Exploitation is limited to environments using YouTrack's mailbox integration feature, and specifically to accounts that have undergone a password reset while the actor retains the prior authentication material - the flaw is that authentication is still accepted through the mailbox integration path after the reset that should have invalidated it. It does not affect deployments that do not use mailbox integration, and it is bounded to Low integrity impact with no confidentiality or availability effect. The realistic limiting factor is the need for a preceding password-reset event plus possession of the now-stale credentials, which makes the practical attack complexity higher than the PR:N/AC:L base vector suggests.

This is a moderate, integrity-only authentication flaw, not a high-priority emergency. The CVSS 3.1 base score is 5.3 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - network-reachable and requiring no privileges or interaction, but with only Low integrity impact and no confidentiality or availability impact. The core weakness (CWE-1188, insecure/improper default initialization) means YouTrack's mailbox integration continued to permit authentication using credentials that a password reset should have invalidated, so the security consequence is a stale-credential access lapse rather than a full account takeover or data breach. No EPSS score, no CISA KEV listing, and no public POC are present in the supplied intelligence, so there is no evidence of active or automatable exploitation - consistent with a targeted, prerequisite-bound issue rather than a widely weaponized one. A signal to flag explicitly: the PR:N/AC:L rating implies trivial unauthenticated exploitation, yet the described mechanism (authentication surviving a password reset via mailbox integration) realistically requires possession of prior/legacy credentials and a preceding reset event, which argues for higher attack complexity - verify the exploitation prerequisites with JetBrains. Overall this is a legitimate hardening fix worth patching on the normal cycle, not a drop-everything item.

A user's YouTrack password is reset (e.g., after suspected compromise or an offboarding), but the mailbox integration path still honors the old authentication material, so an actor holding the pre-reset credentials continues to authenticate and act with Low integrity impact. No public exploit code is identified in the provided data, and exploitation depends on the actor having had valid credentials before the reset.