JetBrains Patches Critical Hub Authentication Bypass and Account Takeover Flaws Across Its IDE Ecosystem
JetBrains patched three critical Hub and YouTrack flaws enabling account takeover and authentication bypass, alongside code-execution fixes across IntelliJ, GoLand, and TeamCity.
Editor's Note ·
- Correction:
- In the "Beyond the Identity Layer" section, the article presents five IDE code-execution vectors inside quotation marks attributed to Cyber Security News ("Filename completion command injection in IntelliJ IDEA," "Guest user account command execution in IntelliJ IDEA," "Untrusted project configuration in GoLand," "Perforce connection settings RCE in TeamCity," and "Unsafe deserialization in Kotlin build cache metadata"). These exact phrasings do not appear verbatim in the Cyber Security News article; they are reformatted labels of the outlet's prose. The vectors themselves are accurately described by the source, which reports RCE via unsafe deserialization in Kotlin build cache metadata, RCE via untrusted GoLand project configuration, IntelliJ IDEA command injection through filename completion and command execution via the guest user account, and a TeamCity RCE through Perforce connection settings.
- Correction:
- The article quotes GBHackers as describing Hub as the "identity and access management component for YouTrack, TeamCity, and other JetBrains services." GBHackers' actual wording is "the central identity and access management component that authenticates users for products such as YouTrack, TeamCity, and other JetBrains services." The quotation compresses the original phrasing without an ellipsis; the meaning is unchanged.
Overview
On July 2, 2026, JetBrains disclosed patches for three critical vulnerabilities in its Hub and YouTrack products that could let attackers take over administrator accounts or bypass standard sign-in controls, according to GBHackers and Cyber Press. In an advisory published to its own blog, JetBrains said the flaws were discovered in May 2026 through “advanced security research that leveraged AI-assisted testing techniques,” and that it had found no evidence of exploitation outside its testing environments, according to JetBrains.
What We Know
The three headline flaws are tracked as CVE-2026-56141, CVE-2026-56142, and CVE-2026-50242. They center on Hub, which GBHackers describes as the “identity and access management component for YouTrack, TeamCity, and other JetBrains services” — meaning a single compromise can ripple across integrated tools.
The most severe, CVE-2026-56141, stems from predictable account-restore codes generated by a weak random number generator (CWE-338), letting an unauthenticated attacker enumerate valid codes and seize any account, according to Cyber Press, which reported that the flaw carries a CVSS score of 9.8. GBHackers similarly described the bug as restore codes with “insufficient randomness” that let attackers “predict or brute-force restore codes to hijack accounts.” In its own advisory, JetBrains characterized CVE-2026-56141 as an “admin account takeover through authentication token forgery” affecting both YouTrack Cloud and YouTrack Server, according to JetBrains.
CVE-2026-50242, an authentication bypass via direct database access, grants administrative control without valid credentials (CWE-306), per GBHackers; JetBrains limited its impact to self-hosted YouTrack Server, according to JetBrains. The third flaw, CVE-2026-56142, lets an attacker attach unauthorized authentication details to existing accounts (CWE-915), which Cyber Press framed as privilege escalation and which JetBrains described as an “email verification bypass.”
The issues are resolved in Hub version 2026.1.13757, with backports to long-term-support branches 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, and 2024.2.148429, according to JetBrains and GBHackers. Versions earlier than 2024.2 do not receive a patch and must be upgraded, JetBrains said. YouTrack Cloud has already been patched and requires no customer action, while operators of self-hosted YouTrack Server are urged to upgrade.
Beyond the Identity Layer
The disclosure extended past Hub and YouTrack to code-execution fixes across JetBrains’ wider IDE and build tooling, according to Cyber Security News. The outlet listed vectors including “Filename completion command injection in IntelliJ IDEA,” “Guest user account command execution in IntelliJ IDEA,” “Untrusted project configuration in GoLand,” “Perforce connection settings RCE in TeamCity,” and “Unsafe deserialization in Kotlin build cache metadata.”
Cyber Press tied specific identifiers to several of those issues, including CVE-2026-53915, a GoLand remote-code-execution bug triggered by loading untrusted project configuration files, and CVE-2026-49373, a command-injection flaw in TeamCity’s Perforce connection settings.
What We Don’t Know
JetBrains’ public blog advisory focused on YouTrack and did not enumerate CVSS scores for the individual IDE fixes, according to JetBrains. The company reported no exploitation outside its own testing but did not say how long self-hosted deployments had been vulnerable before the May 2026 discovery.
Analysis
Because Hub underpins authentication for several JetBrains products, the account-takeover and bypass flaws are most consequential for organizations running self-hosted deployments rather than the vendor-managed cloud, which JetBrains says it has already patched, according to JetBrains. Cyber Security News urged administrators to prioritize upgrading Hub and YouTrack to the latest available versions and to pair the patches with credential rotation, multi-factor authentication enforcement, and access-control reviews. The company’s disclosure that AI-assisted testing surfaced the flaws also adds to a growing 2026 pattern of automated tooling uncovering vulnerabilities in widely used developer software.