JetBrains has released patches for several critical vulnerabilities in JetBrains Hub that could allow for full authentication bypass, account takeover, and unauthorized privilege escalation across integrated JetBrains services. Administrators are urged to update their Hub instances immediately.
Critical Hub Vulnerabilities
JetBrains’ latest fixed-issues bulletin highlights three new critical vulnerabilities affecting Hub, the central identity and access management component that authenticates users for products such as YouTrack, TeamCity, and other JetBrains services.
All three issues have been resolved in Hub version 2026.1.13757 and have been backported to several Long-Term Support (LTS) branches, including 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, and 2024.2.148429.
CVE-2026-56141 – Account Takeover via Predictable Restore Codes
The most severe issue, tracked as CVE-2026-56141 and reported by researcher Ngoc Thuan, allows for account takeover due to predictable restore codes used in Hub’s account recovery flow.
JetBrains indicates that Hub’s recovery mechanism generated restore codes with insufficient randomness, leading to a vulnerability categorized under CWE-338 (Use of Cryptographically Weak Pseudo-Random Number Generator).
This weakness meant that an attacker could predict or brute-force restore codes to hijack accounts, including those with high-privilege identities, if they knew or could guess the associated usernames or email addresses.
Since Hub acts as the identity provider for multiple JetBrains services, compromise of a single Hub account could lead to unauthorized access across various platforms, including issue trackers, CI/CD servers, and other integrated systems.
JetBrains has strengthened restore code generation in the patched releases and recommends treating this as a high-priority update for any internet-exposed or multi-tenant Hub deployments.
CVE-2026-56142 – Privilege Escalation via Attached Authentication Details
The second critical Hub issue, CVE-2026-56142 (CWE-915 – Improperly Controlled Modification of Dynamically-Determined Object Attributes), arises from the ability to attach authentication details to accounts in an unsafe manner.
JetBrains notes that an authenticated user could manipulate linked authentication records to escalate their privileges, effectively binding more powerful authentication contexts or identities to their own account.
In environments where Hub serves as a central Single Sign-On (SSO) broker, this vulnerability could permit a lower-privileged user to gain administrative roles or access restricted projects and resources without direct administrative approval.
The fix introduces stricter server-side validation of authentication mappings. It enforces proper authorization checks when attaching or modifying authentication details for Hub accounts.
CVE-2026-50242 – Hub Authentication Bypass Leading to Admin Access
The third critical flaw, CVE-2026-50242, is described by JetBrains as an authentication bypass via direct database access that could lead to administrative access in Hub.
Classified under CWE-306 (Missing Authentication for Critical Function), this vulnerability allowed attackers to reach sensitive functions or configuration paths by abusing database-level logic, thereby bypassing standard sign-in controls.
JetBrains credits researcher Tuan Anh Lai for reporting this issue, and the fixes have been implemented in Hub version 2026.1 and are supported in 2025.x/2024.x branches.
The same CVE identifier also applies to YouTrack, indicating that similar bypasses could affect It when integrated with Hub, thereby underscoring the shared risk across the JetBrains ecosystem.
Since Hub underpins authentication and authorization across multiple JetBrains products, successful exploitation of any of these three vulnerabilities could result in a complete compromise of development and DevOps infrastructure.
Attackers who gain Hub administrator rights or hijack privileged accounts can access connected services, such as YouTrack and TeamCity, and obtain access to confidential project data, as well as manipulate CI/CD pipelines.
JetBrains advises customers to upgrade Hub to version 2026.1.13757 or the latest available patch for the 2025.3, 2025.2, 2025.1, 2024.3, or 2024.2 branches. Customers should ensure that all integrated products are also updated to match the fixed versions listed in the bulletin.
Security teams should prioritize upgrading internet-facing Hub instances, rotating sensitive credentials, reviewing audit logs for unusual account recovery or authentication mapping activities, and enforcing strong Multi-Factor Authentication (MFA) to mitigate potential risks from prior exploitation.
Interact with Cyber Threats in Windows, Linux, macOS VMs to Trigger Full Attack Chain - Analyse Malware & Phishing with ANY RUN
