EUVD-2026-33389
GHSA-mhr7-j6qx-58mw
Severity by source
AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:N/A:N
Lifecycle Timeline
2DescriptionCVE.org
In JetBrains TeamCity before 2026.1 stored XSS on the SAML login page was possible
AnalysisAI
Stored cross-site scripting in JetBrains TeamCity's SAML login page allows a high-privileged attacker to inject persistent malicious scripts that execute in victims' browsers upon visiting the login page. All TeamCity versions prior to 2026.1 are affected. The changed scope (S:C) in the CVSS vector indicates the injected payload can affect browser sessions beyond the immediate component, though confidentiality impact is rated low and no integrity or availability loss is assessed. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Technical ContextAI
The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-site Scripting), specifically the stored (persistent) variant. JetBrains TeamCity is a CI/CD platform; its SAML login page facilitates federated authentication via Security Assertion Markup Language, commonly used in enterprise SSO configurations. The affected CPE is cpe:2.3:a:jetbrains:teamcity:*:*:*:*:*:*:*:*, encompassing all platform variants before 2026.1. Stored XSS on an authentication page is particularly sensitive because the login page is visited by all users relying on SAML SSO, and injected payloads persist server-side, executing for every subsequent visitor without further attacker interaction after initial injection.
RemediationAI
Upgrade JetBrains TeamCity to version 2026.1 or later, which contains the vendor-released patch for this stored XSS on the SAML login page. The fix is confirmed by JetBrains at https://www.jetbrains.com/privacy-security/issues-fixed/. As a compensating control for organizations unable to patch immediately, restricting admin-level access to the minimum necessary set of trusted accounts reduces the attacker surface significantly, since exploitation requires PR:H (high privileges). Additionally, if SAML SSO is not in active use, disabling the SAML login page configuration eliminates exposure entirely for that deployment, though this would impact SSO-dependent users. Organizations should audit admin account activity for any unexpected changes to SAML-related configuration.
In JetBrains TeamCity before 2023.11.4 authentication bypass allowing to perform admin actions was possible. Rated criti
In JetBrains TeamCity before 2023.05.4 authentication bypass leading to RCE on TeamCity Server was possible. Rated criti
In JetBrains TeamCity before 2023.11.3 authentication bypass leading to RCE was possible. Rated critical severity (CVSS
In JetBrains TeamCity before 2024.07 access tokens could continue working after deletion or expiration. Rated critical s
In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 authentication bypass was possible in specific e
In JetBrains TeamCity before 2023.05 bypass of permission checks allowing to perform admin actions was possible. Rated c
JetBrains TeamCity before 2021.2.3 was vulnerable to OS command injection in the Agent Push feature configuration. Rated
In JetBrains TeamCity before 2021.2.1, XXE during the parsing of the configuration file was possible. Rated critical sev
In JetBrains TeamCity before 2021.1.4, GitLab authentication impersonation was possible. Rated critical severity (CVSS 9
In JetBrains TeamCity before 2021.1.3, the X-Frame-Options header is missing in some cases. Rated critical severity (CVS
In JetBrains TeamCity before 2021.1.2, permission checks in the Agent Push functionality were insufficient. Rated critic
In JetBrains TeamCity before 2021.1.2, remote code execution via the agent push functionality is possible. Rated critica
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today