Token Validation Flaw in JetBrains Datalore Affects User Sessions
CVE-2026-123282

7.4HIGH

Key Information:

Vendor

Jetbrains
Status
Datalore
Vendor
CVE Published:
6 November 2026

What is CVE-2026-123282?

JetBrains Datalore prior to version 2026.4 has a vulnerability that stems from the lack of expiration validation for account tokens. This oversight allows an attacker or unauthorized user to initiate a new authenticated session without proper authorization, potentially compromising user data and account integrity. Users of affected versions are encouraged to upgrade promptly to ensure their accounts are secured.

Affected Version(s)

Datalore 0 < 2026.4

References

https://www.jetbrains.com/privacy-security/issues-fixed/

CVSS V3.1

Score:
7.4
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.