EUVD-2026-33384
GHSA-qhvc-3ggx-6rj7
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Primary rating from Vendor (JetBrains) · only source for this CVE.
CVSS VectorVendor: JetBrains
Lifecycle Timeline
3DescriptionCVE.org
In JetBrains TeamCity before 2026.1 insufficient username validation in the SAML plugin
AnalysisAI
Insufficient username validation in the SAML plugin of JetBrains TeamCity before 2026.1 allows unauthenticated remote attackers to bypass authentication controls and gain unauthorized access to CI/CD resources. The flaw (CWE-863, Incorrect Authorization) permits manipulation of the username field within SAML assertions, potentially enabling impersonation of legitimate users and unauthorized read/write access to build configurations and pipeline data. No public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA KEV catalog.
Technical ContextAI
JetBrains TeamCity is an enterprise CI/CD platform that optionally supports SAML 2.0-based Single Sign-On via a dedicated SAML plugin. SAML authentication relies on digitally signed XML assertions issued by an Identity Provider (IdP), with the Service Provider (TeamCity) validating and consuming those assertions to authenticate users. CWE-863 (Incorrect Authorization) indicates the root cause is a failure to properly enforce authorization rules during SAML username processing - the plugin does not sufficiently validate the username attribute in the incoming SAML response before granting access. This class of flaw can allow an attacker to supply a crafted or forged username value that bypasses account-level access controls. The affected CPE is cpe:2.3:a:jetbrains:teamcity:*:*:*:*:*:*:*:*, covering all TeamCity versions prior to 2026.1.
RemediationAI
Upgrade JetBrains TeamCity to version 2026.1 or later, which resolves the insufficient username validation in the SAML plugin. The vendor advisory is published at https://www.jetbrains.com/privacy-security/issues-fixed/. As an interim workaround prior to patching, disable SAML SSO in TeamCity and revert to native TeamCity authentication or an alternative federation method - note that this will disrupt any SSO workflows and require users to authenticate via local credentials. Additionally, restricting network access to the TeamCity server to known trusted IP ranges (e.g., internal corporate networks and authorized IdP hosts only) reduces the attack surface at the network perimeter. If SAML SSO must remain active, review IdP trust configurations and ensure only authorized Identity Providers are whitelisted in TeamCity SAML settings.
Path traversal in JetBrains TeamCity before 2023.11.4 enables remote attackers to perform a limited set of administrativ
Remote code execution in JetBrains TeamCity before 2026.1.3 and 2025.11.7 allows unauthenticated attackers to execute ar
In JetBrains TeamCity before 2023.11.4 authentication bypass allowing to perform admin actions was possible. Rated criti
In JetBrains TeamCity before 2023.05.4 authentication bypass leading to RCE on TeamCity Server was possible. Rated criti
In JetBrains TeamCity before 2023.11.3 authentication bypass leading to RCE was possible. Rated critical severity (CVSS
Remote code execution in JetBrains TeamCity before 2026.1.2 and 2025.11.6 allows an attacker to escape the Kotlin DSL sa
In JetBrains TeamCity before 2024.07 access tokens could continue working after deletion or expiration. Rated critical s
In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 authentication bypass was possible in specific e
In JetBrains TeamCity before 2023.05 bypass of permission checks allowing to perform admin actions was possible. Rated c
JetBrains TeamCity before 2021.2.3 was vulnerable to OS command injection in the Agent Push feature configuration. Rated
In JetBrains TeamCity before 2021.2.1, XXE during the parsing of the configuration file was possible. Rated critical sev
In JetBrains TeamCity before 2021.1.4, GitLab authentication impersonation was possible. Rated critical severity (CVSS 9
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today