EUVD-2026-90021
GHSA-mqhr-7f7q-h475
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain valid notification signature
-
DeliveryReplay signature to YouTrack
-
ExploitBypass authorization check (CWE-863)
-
ExecutionAssume victim account identity
-
ImpactFull account takeover
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization logic validation
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to first obtain a valid YouTrack notification signature and then replay it to the application, which then fails to reject the reused signature (CWE-863 authorization flaw), granting takeover of the associated account. The limiting factor is acquisition of a legitimate signature - the attack is not a blind unauthenticated request against a default install but depends on capturing or observing a victim's notification signature; only YouTrack instances running versions before 2026.2.19197 are affected, and upgrading to 2026.2.19197 remediates it. |
| Impact | The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) scores this 9.8 CRITICAL, implying trivial remote unauthenticated full compromise. However, the real-world signals temper that headline number and partly conflict with it. EPSS is low at 0.33% (24th percentile), there is no CISA KEV listing, and CISA SSVC rates Exploitation as 'none' and Automatable as 'no' - all indicating no observed or easily-scaled exploitation despite a 'total' technical impact. The vulnerability class (CWE-863 authorization, account takeover via replaying a notification signature) inherently requires the attacker to first obtain a valid notification signature to replay, which is a meaningful precondition the AC:L rating arguably understates - I would independently assess this closer to AC:H. Net: this is a genuine high-severity authorization flaw that should be patched promptly, but it is not currently a widely-weaponized or automatable threat, so it ranks below any KEV-listed or high-EPSS item in a triage queue. The vendor-reported, patch-available status and low EPSS point toward a responsibly-disclosed defect rather than active in-the-wild abuse. |
| Exploit ScenarioDerived | An attacker obtains a valid notification signature (e.g. from a captured or observed YouTrack notification) and replays it against the application to assume the identity of the targeted account, achieving account takeover without needing that user's credentials. No public exploit has been identified at time of analysis, and the attack is remote but depends on first acquiring a replayable signature. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Oct 02, 2026
Account takeover in JetBrains YouTrack before 2026.2.19197 is possible because the application accepts a replayed notification signature, allowing an attacker who has captured a legitimate signature to authenticate as the associated account. Every YouTrack instance running an earlier build is affected (CPE cpe:2.3:a:jetbrains:youtrack:*:*:*:*:*:*:*:*), and the root cause is an incorrect-authorization flaw (CWE-863) rather than memory corruption. The practical barrier is signature acquisition: our assessment rates this CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N (high, not the input's 9.8 critical) because exploitation depends on capturing or observing a victim's notification signature rather than a blind unauthenticated request against a default install. No public exploit code and no confirmed active exploitation have been identified (EPSS 0.33%, 24th percentile; CISA SSVC lists Exploitation: none), and JetBrains has released a fix in 2026.2.19197.
Earlier versions of this analysis (1)
Account takeover in JetBrains YouTrack before 2026.2.19197 can occur when a valid notification signature is replayed to the server, allowing an unauthenticated remote attacker to take over the account tied to that signature. The CVSS 3.1 vector is AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L, reflecting remote reachability without pre-authentication or user interaction but a high-complexity prerequisite of obtaining the legitimate signature. No public exploit identified at time of analysis, and this is a high-priority issue within affected YouTrack deployments rather than a mass-exploitation emergency.
RemediationAI
Vendor-released patch: upgrade to YouTrack 2026.2.19197 (or later) as documented on JetBrains' fixed-issues page at https://www.jetbrains.com/privacy-security/issues-fixed/ and confirm the running build number after upgrade; YouTrack Cloud customers should verify with JetBrains that their instance is on the remediated build, while self-hosted operators must apply the update themselves since no automatic upgrade occurs. Because exploitation depends on an attacker obtaining a legitimate notification signature, the most effective compensating controls until patching are exposure-reduction measures: restrict YouTrack reachability to trusted networks or a VPN/reverse-proxy allowlist and disable public-internet exposure of notification-bearing endpoints (trade-off: external collaborators, email clients, and mobile users on untrusted networks lose direct access until they connect through the allowed path); where the deployment supports it, reduce notification-signature validity/lifetime or rotate any signing secret so previously issued signatures no longer verify (trade-off: in-flight notification links for legitimate users break and users may need new notifications re-sent). Additionally, treat notifications as sensitive material: enforce transport security and DMARC-style protections on the mail path, audit shared mailboxes and auto-forward rules that could expose notification content, and alert on anomalous authentication or session-creation events tied to notification links. Disabling notifications entirely is not recommended as a general workaround because it removes a core YouTrack workflow, and there is no evidence in the available data that issuing arbitrary replayed signatures is possible without first capturing a genuine one.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is an authorization/authentication-bypass defect (CWE-863, Incorrect Authorization) in YouTrack's signature-based notification handling. YouTrack embeds cryptographically derived signatures into notification content (for example, links or action tokens sent to users) and, in affected builds, the server fails to enforce single-use semantics - there is no effective nonce, expiry, or one-time binding to the originating session - so a valid signature remains usable after its first legitimate use. An attacker who can obtain such a signature (intercepting or observing a victim's notification, e.g. via shared mailboxes, mail-forwarding rules, proxy logs, or a compromised inbox) can replay it and have the server treat the request as the victim's authenticated action, resulting in full account takeover. The CVSS vector supplied in CVE metadata is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (9.8), but the AC:L/UI:N reading overstates reachability; our assessment applies AC:H because the attacker must first acquire a valid signature, and lowers the integrity/confidentiality weighting to C:H/I:H/A:N while keeping PR:N. The affected product set is the single CPE family cpe:2.3:a:jetbrains:youtrack (all builds before 2026.2.19197); ENISA records the same range as YouTrack 0 <2026.2.19197 under EUVD-2026-90021. The associated tags - Authentication Bypass, JetBrains, YouTrack - align with the CWE-863 classification and confirm this is a session/identity-trust problem rather than input-handling or injection.
Know when Youtrack gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Remote and no authentication (PR:N), but replaying requires first capturing a valid notification signature so AC:H; account takeover yields high C and I, with no direct availability impact.
Primary rating from Vendor (JetBrains).
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
In JetBrains YouTrack before 2026.2.19197 account takeover was possible by replaying a notification signature
Executive ViewAI
JetBrains YouTrack versions before 2026.2.19197 contain an account takeover flaw that could let an attacker impersonate legitimate users if they obtain a valid notification signature. This affects any organization using an unpatched YouTrack instance, potentially exposing project data, workflows, and integrated credentials. A vendor patch is available, and no public exploit identified at time of analysis, so remediation should be prioritized but is not emergency-driven.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Unauthenticated remote attackers can execute arbitrary code in JetBrains YouTrack before 2026.2.19197 by abusing an auth
Unauthenticated account takeover in JetBrains YouTrack's Helpdesk feature allows a remote attacker to hijack existing ac
Authentication bypass in JetBrains YouTrack allows attackers to obtain full administrative access by leveraging a direct
In JetBrains YouTrack before 2024.3.51866 system takeover was possible through path traversal in plugin sandbox. Rated c
JetBrains YouTrack before 2021.4.40426 was vulnerable to SSTI (Server-Side Template Injection) via FreeMarker templates.
JetBrains YouTrack before 2021.3.23639 is vulnerable to Host header injection. Rated critical severity (CVSS 9.8), this
In JetBrains YouTrack before 2020.5.3123, server-side template injection (SSTI) was possible, which could lead to code e
An SSRF attack was possible on a JetBrains YouTrack server. Rated critical severity (CVSS 9.8), this vulnerability is re
Certain actions could cause privilege escalation for issue attachments in JetBrains YouTrack. Rated critical severity (C
An Insecure Direct Object Reference, with Authorization Bypass through a User-Controlled Key, was possible in JetBrains
A query injection was possible in JetBrains YouTrack. Rated critical severity (CVSS 9.8), this vulnerability is remotely
Unauthenticated database backup disclosure in JetBrains YouTrack before 2025.3.156085, 2026.1.13913, and 2026.2.18112 al
Exploit-DB