Cross-Site Request Forgery in JetBrains TeamCity Affecting GitHub App Integration
CVE-2025-54528

8.8HIGH

Key Information:

Vendor

Jetbrains
Status
Teamcity
Vendor
CVE Published:
28 July 2025

What is CVE-2025-54528?

In versions of JetBrains TeamCity before 2025.07, a Cross-Site Request Forgery (CSRF) vulnerability was identified that could potentially allow unauthorized actions within the GitHub App connection flow. This type of vulnerability could be exploited by attackers to perform malicious requests on behalf of authenticated users, leading to unauthorized access or changes to resources. Users are advised to update their TeamCity installations to mitigate the risks associated with this vulnerability.

Affected Version(s)

TeamCity 0 < 2025.07

References

https://www.jetbrains.com/privacy-security/issues-fixed/

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.
CVE-2025-54528 : Cross-Site Request Forgery in JetBrains TeamCity Affecting GitHub App Integration