Two-Factor Authentication Bypass in JetBrains Hub
CVE-2026-123295

8.1HIGH

Key Information:

Vendor

Jetbrains
Status
Hub
Vendor
CVE Published:
6 November 2026

What is CVE-2026-123295?

A security vulnerability in JetBrains Hub prior to version 2026.2.52519 allows attackers to disable two-factor authentication through the profile update endpoint. This flaw can lead to unauthorized access, compromising user accounts. It is crucial for all users to update to the latest version to protect against potential exploitation.

Affected Version(s)

Hub 0 < 2026.2.52519

References

https://www.jetbrains.com/privacy-security/issues-fixed/

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.