Missing authentication in JetBrains Hub
Priority MEDIUM 50CWE-306Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-306.
Summary
In JetBrains Hub before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 authentication bypass via direct database access leading to administrative access was possible
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00611 49th percentileScored 2026-11-07
Fix Fixed Hub (JetBrains): 2026.1.13757,
2025.3.148033,
2025.2.148048,
2025.1.148120,
2024.3.148430,
2024.2.148429
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| JetBrains | Hub | before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 | 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 | Patch available | CNA |
- Hub VendorJetBrains Affected before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 Fixed in 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:jetbrains:hub:*:*:*:*:*:*:*:* | 2024.2.33606 to before 2024.2.148429; 2024.3.44799 to before 2024.3.148430; 2025.1.62455 to before 2025.1.148120; 2025.2.86069 to before 2025.2.148048; 2025.3.104432 to before 2025.3.148033; 2026.1.12024 to before 2026.1.13757 | Vulnerable | JetBrains |
- cpe:2.3:a:jetbrains:hub:*:*:*:*:*:*:*:* Versions 2024.2.33606 to before 2024.2.148429; 2024.3.44799 to before 2024.3.148430; 2025.1.62455 to before 2025.1.148120; 2025.2.86069 to before 2025.2.148048; 2025.3.104432 to before 2025.3.148033; 2026.1.12024 to before 2026.1.13757 Vulnerable ·JetBrains
Remediation
- Fix · CNA Hub (JetBrains) Fixed in 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
JetBrains Hub 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429
3 records Highest priority Priority MEDIUM 3 MEDIUM
Other records, highest priority first
- TI-2026-40517 In JetBrains Hub before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120…Priority MEDIUM 49
- TI-2026-40518 Mass assignment in JetBrains HubPriority MEDIUM 44
Timeline
- 2026-10-02 Threatist record created from CVE-2026-50242
- 2026-10-03 Alias added: GHSA-xqpc-xqhc-3crx
References
More JetBrains Hub vulnerabilities
- TI-2026-40517 In JetBrains Hub before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120… CVSS 3.1CRITICAL 9.8
- TI-2026-20894 In JetBrains Hub before 2025.3.119807 authentication bypass allowing administrative actions was possible CVSS 3.1CRITICAL 9.8
- TI-2022-08968 In JetBrains Hub before 2022.1.14434, SAML request takeover was possible. CVSS 3.1CRITICAL 9.8
- TI-2026-40518 Mass assignment in JetBrains Hub CVSS 3.1CRITICAL 9.6
- TI-2022-08966 JetBrains Hub before 2021.1.14276 was vulnerable to blind Server-Side Request Forgery (SSRF). CVSS 3.1CRITICAL 9.1
- TI-2021-19195 In JetBrains Hub before 2021.1.13690, the authentication throttling mechanism could be bypassed. CVSS 3.1CRITICAL 9.8
Sources
- CVE-2026-50242 · CVE Program
- CVE-2026-50242 · NVD
- FIRST EPSS
- GHSA-xqpc-xqhc-3crx · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences