JetBrains YouTrack EUVD-2026-72502

Exploitation requires that the target YouTrack instance has the VCS webhook secret field left blank - any non-empty configured secret renders the endpoint immune to this flaw. This is the sole enabling condition; the vulnerability is not present in correctly configured deployments. Remote network access to the YouTrack webhook endpoint is necessary (AV:N), but no authentication, user interaction, or elevated privileges are required to send the forged request. The AC:H rating in the CVSS vector reflects this non-default blank-secret prerequisite. Exploitation is further limited by any firewall or reverse-proxy rules restricting access to the webhook path, and by the low impact ceiling - an attacker can inject webhook events but cannot read credentials, access data, or cause service disruption.

The vendor-assigned CVSS 3.7 (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N) is well-calibrated for this flaw. AC:H correctly captures that exploitation is gated on a specific misconfiguration - a blank webhook secret - rather than being universally applicable to all YouTrack deployments. Integrity impact is limited (I:L): a successful attacker can inject forged VCS events that trigger automated processing, such as spurious issue state changes, but cannot read data or disrupt service. No EPSS data was provided in the input; active exploitation is not confirmed (not listed in CISA KEV) and no public exploit code is known, making real-world risk low despite the network-accessible vector. The 'Authentication Bypass' tag is broadly accurate - the auth check is absent, not bypassed through a bypass technique - though 'Missing Authentication' would be a more precise label. Organizations that follow security hardening baselines and always configure webhook secrets are entirely unaffected; only those with blank-secret configurations are exposed.

An attacker who identifies a YouTrack instance with a blank VCS webhook secret crafts and submits HTTP POST requests to the generic VCS webhook endpoint, mimicking legitimate repository event payloads. Because the server performs no secret validation when the secret is unset, it processes the forged payload as authentic and may trigger automated issue state changes or workflow rule executions. No public exploit code is known, and the attacker must first determine that the target deployment has not configured a webhook secret.