What is the CVSS score of EUVD-2026-38006?

EUVD-2026-38006 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of JetBrains Hub are affected by EUVD-2026-38006?

JetBrains Hub, a critical identity management platform, contains a vulnerability enabling remote unauthenticated attackers to take over arbitrary user accounts through predictable password restore…. A patch is available.

How to fix or mitigate EUVD-2026-38006?

24 hours: Inventory all JetBrains Hub instances and document current versions; enable audit logging for all account recovery attempts; implement network-level access restrictions to Hub administrative interfaces. 7 days: Enforce multi-factor authentication (MFA) on all user accounts; strengthen password policies to minimum 12 characters with special characters; disable or restrict restore code functionality if operationally feasible; analyze past 30 days of access logs for suspicious account recovery activity. 30 days: Monitor JetBrains advisories for patch release; prepare upgrade plan targeting versions 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, or 2024.2.148429; conduct post-upgrade security validation.

JetBrains Hub EUVD-2026-38006

| CVE-2026-56141 CRITICAL

Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) (CWE-338)

2026-06-19 JetBrains

GHSA-cq2r-w6jr-x35w

Information Disclosure Hub

9.8

CVSS 3.1 · Vendor: JetBrains

Severity by source

Vendor (JetBrains) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Network-reachable recovery flow with no auth or UI, but predicting a restore code within its validity window is non-trivial, so AC:H; full account takeover yields C/I/A:H.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (JetBrains).

CVSS VectorVendor: JetBrains

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jun 19, 2026 - 14:31 EUVD

Analysis Generated

Jun 19, 2026 - 13:00 vuln.today

CVE Published

Jun 19, 2026 - 11:49 cve.org

CRITICAL 9.8

DescriptionCVE.org

In JetBrains Hub before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 account takeover via predictable restore codes was possible

AnalysisAI

Account takeover in JetBrains Hub is possible through predictable restore codes, affecting all versions prior to 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, and 2024.2.148429. Remote unauthenticated attackers can guess or predict the restore codes used for account recovery, enabling them to seize control of arbitrary user accounts. No public exploit identified at time of analysis, but the CVSS 9.8 rating reflects the high impact of full account compromise across an identity management platform.

Technical ContextAI

JetBrains Hub is the centralized authentication and user management service used to tie together JetBrains products such as YouTrack, TeamCity, and Upsource into a single identity store. The vulnerability maps to CWE-338 (Use of Cryptographically Weak Pseudo-Random Number Generator), meaning the restore (account recovery) codes are generated using a non-cryptographic or otherwise predictable PRNG, allowing an attacker to anticipate valid codes rather than having to brute-force the full key space. Because Hub serves as the identity provider for federated JetBrains tooling, compromise of a Hub account can cascade into access to source code, build infrastructure, and issue trackers governed by that identity.

RemediationAI

Vendor-released patch: upgrade JetBrains Hub to 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, or 2024.2.148429 depending on the maintenance branch in use, per https://www.jetbrains.com/privacy-security/issues-fixed/. Until patching is complete, restrict network access to the Hub service to trusted administrative networks or VPN, monitor authentication and password-reset logs for unusual restore-code submissions or successful logins following recent recovery requests, and consider temporarily disabling self-service account recovery if the deployment supports it - recognizing that this will force legitimate users to recover accounts through administrators. Rotate any high-value credentials managed through Hub after upgrading, since exploitation could have occurred prior to the fix being applied.