EUVD-2026-38008
GHSA-xqpc-xqhc-3crx
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Description ties the bypass to 'direct database access,' a privileged prerequisite, so PR:H rather than vendor's PR:N; once met, complexity is low and impact is total (C/I/A:H).
Primary rating from Vendor (JetBrains).
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
7DescriptionNVD
In JetBrains Hub before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 authentication bypass via direct database access leading to administrative access was possible
AnalysisAI
Authentication bypass in JetBrains Hub (the identity and account-management server behind TeamCity, YouTrack, and other JetBrains tools) lets an actor obtain administrative access by going through direct database access, per JetBrains' own advisory. Classified under CWE-306 (Missing Authentication for a Critical Function) and vendor-scored CVSS 9.8, it affects all builds before the fixed 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, and 2024.2.148429 releases. There is no public exploit identified at time of analysis and the EPSS probability is low (0.44%, 35th percentile), but full administrative compromise is the stated technical impact.
Technical ContextAI
JetBrains Hub is a centralized authentication and user/account management service providing single sign-on and permission management across the JetBrains ecosystem (TeamCity CI/CD, YouTrack issue tracking, and related tools). The root cause is CWE-306, Missing Authentication for a Critical Function: a privileged path - here described as 'direct database access' - does not enforce the authentication checks that gate administrative functionality, so identity/authorization can be established without completing normal login. Because Hub is the trust anchor for the products federating to it, a defect that yields administrative access to Hub effectively undermines authentication for everything that relies on it. The single affected CPE is cpe:2.3:a:jetbrains:hub:*:*:*:*:*:*:*:*.
RemediationAI
Apply the vendor-released patch by upgrading JetBrains Hub to the fixed build on your release line: 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, or 2024.2.148429 (whichever matches your major version); details are on JetBrains' fixed-issues page at https://www.jetbrains.com/privacy-security/issues-fixed/. Until you can patch, restrict network and host access to Hub's backend database - ensure the database listens only on localhost or a tightly firewalled segment, is not exposed to general application/user networks, and uses strong, rotated credentials - since the bypass is described as occurring 'via direct database access'; this hardening has minimal functional impact when Hub and its DB are co-located but will break setups relying on remote DB connectivity, which should then be confined to an isolated management segment. Additionally place Hub's web/admin interface behind a VPN or IP allowlist and audit existing admin accounts and sessions for unexpected entries; note IP allowlisting can disrupt legitimate distributed access and should be scoped to known operator ranges.
Resource exhaustion DoS in @anephenix/hub (npm) before 0.2.16 allows any unauthenticated remote client to exhaust server
Privileged GITHUB_TOKEN exfiltration in the meltano/hub repository allows any unauthenticated attacker who can open a pu
Insecure permissions in Hubert Imoveis e Administracao Ltda Hub v2.0 1.27.3 allows authenticated attackers with low-leve
Account takeover in JetBrains Hub is possible through predictable restore codes, affecting all versions prior to 2026.1.
Hub v2.0 property management system allows unauthenticated arbitrary file upload via /utils/uploadFile. Malicious PDF fi
In JetBrains Hub before 2022.1.14434, SAML request takeover was possible. Rated critical severity (CVSS 9.8), this vulne
In JetBrains Hub before 2021.1.13690, the authentication throttling mechanism could be bypassed. Rated critical severity
In JetBrains Hub before 2021.1.13389, account takeover was possible during password reset. Rated critical severity (CVSS
JetBrains Hub before 2025.3.119807 has an authentication bypass allowing administrative actions without proper credentia
JetBrains Hub before 2021.1.14276 was vulnerable to blind Server-Side Request Forgery (SSRF). Rated critical severity (C
Privilege escalation in JetBrains Hub (versions prior to 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024
The am function in lib/hub/commands.rb in hub before 1.12.1 allows local users to overwrite arbitrary files via a symlin
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today