EUVD-2026-33388
GHSA-wcfj-vvvg-4x96
Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N
Lifecycle Timeline
2DescriptionCVE.org
In JetBrains TeamCity before 2026.1 open redirect in the SAML plugin was possible
AnalysisAI
Open redirect in JetBrains TeamCity's SAML authentication plugin (all versions before 2026.1) allows a remote unauthenticated attacker to redirect authenticated users to arbitrary external URLs during the SAML login flow. The vulnerability carries a CVSS 3.1 score of 3.1 (Low), reflecting high attack complexity and mandatory user interaction - limiting realistic exploitation to targeted phishing scenarios against TeamCity users leveraging SAML SSO. No public exploit code exists and no active exploitation has been confirmed.
Technical ContextAI
TeamCity's SAML plugin implements federated identity via the Security Assertion Markup Language protocol, which inherently involves redirect URLs as part of the authentication handshake (e.g., RelayState or redirect_uri parameters). CWE-601 (URL Redirection to Untrusted Site / 'Open Redirect') identifies the root cause: insufficient validation of redirect target URLs supplied through the SAML flow allows an attacker to supply an external, attacker-controlled destination. The affected CPE is cpe:2.3:a:jetbrains:teamcity:*:*:*:*:*:*:*:*, covering all TeamCity versions across platforms prior to 2026.1. This class of vulnerability is commonly weaponized in phishing chains to lend legitimacy to malicious links by routing victims through a trusted domain before forwarding them onward.
RemediationAI
Upgrade JetBrains TeamCity to version 2026.1 or later, which is the implied fixed release per the vendor's security advisory at https://www.jetbrains.com/privacy-security/issues-fixed/. Note: the exact patch version is inferred from the vulnerability scope ('before 2026.1') rather than an explicitly stated fixed-version field - verify the specific build number against the JetBrains advisory page. If immediate upgrade is not feasible, a compensating control is to disable the SAML plugin entirely via TeamCity's administration panel (Administration > Authentication) and revert to an alternative authentication method; this fully eliminates the attack surface but will disrupt SSO-dependent users and requires an alternative IdP integration or fallback credential strategy. Additionally, restricting network access to the TeamCity instance to trusted IP ranges reduces exposure for the UI:R interaction step.
More in Open Redirect
View allA malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL ca
GFI Kerio Control versions 9.2.5 through 9.4.5 contain an HTTP response splitting vulnerability in the dest parameter of
PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect
Multiple open redirect vulnerabilities in Apache Struts 2.0.0 through 2.3.15 allow remote attackers to redirect users to
Open redirect vulnerability in age-verification.php in the Age Verification plugin 0.4 and earlier for WordPress allows
Open redirect vulnerability in Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.29, 8.x before 8.0.0.18, 9.0 b
Vulnerability in the Oracle Applications Framework component of Oracle E-Business Suite (subcomponent: Popup windows (li
Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware 10.1.4.3
Flarum is open source discussion platform software. Rated medium severity (CVSS 6.5), this vulnerability is remotely exp
Open redirect vulnerability in Novius OS 5.0.1 (Elche) allows remote attackers to redirect users to arbitrary web sites
Open redirect vulnerability in the Redirect function in stageshow_redirect.php in the StageShow plugin before 5.0.9 for
Nteract v.0.28.0 was discovered to contain a remote code execution (RCE) vulnerability via the Markdown link. Rated crit
Share
External POC / Exploit Code
Leaving vuln.today