JetBrains TeamCity EUVD-2026-33388

The SAML authentication plugin must be enabled and actively configured in the TeamCity instance - this is a non-default plugin requiring deliberate administrator setup for federated identity. Exploitation further requires user interaction (UI:R): the victim must click a crafted link and proceed through the SAML authentication flow. Attack complexity is rated High (AC:H), indicating that successful exploitation requires specific, non-trivial conditions such as precise SAML parameter manipulation tied to the target deployment's IdP configuration. Authentication is not required of the attacker (PR:N) since the redirect manipulation occurs within the unauthenticated SAML initiation phase. Limiting factors include: SAML plugin must be enabled, victim must interact with a crafted URL, and the attack is inherently targeted rather than opportunistic.

The aggregate risk signal here is consistently low. The CVSS 3.1 score of 3.1 reflects AV:N (network reachable) but is substantially dampened by AC:H (high attack complexity), UI:R (requires victim interaction), and impact limited solely to I:L (low integrity - no confidentiality or availability impact). There is no EPSS score provided in the source data, no CISA KEV listing, and no known public proof-of-concept. The practical attack requires an adversary to craft a precisely manipulated SAML redirect, deliver it to a specific TeamCity user who must then interact with it, making mass exploitation implausible. This is not a high-urgency patch from a risk-prioritization standpoint, but organizations with SAML SSO enabled and internet-facing TeamCity instances should still remediate given the trivial patch path. No conflicting signals exist between the CVSS vector and the description - both align with a limited-scope, user-dependent, phishing-class vulnerability.

An attacker targeting a specific organization's TeamCity deployment crafts a SAML authentication URL that encodes a redirect to an attacker-controlled phishing site, exploiting insufficient URL validation in the SAML plugin. The attacker delivers this link (e.g., via email or chat) to a TeamCity user; upon clicking and completing SAML authentication through the legitimate TeamCity server, the victim is silently forwarded to the malicious site, which may harvest credentials or deliver malware under the guise of a trusted internal redirect. No public proof-of-concept is available at time of analysis.