Two‑Factor Authentication Bypass via Password Reset in JetBrains Hub

In JetBrains Hub before 2026.2.52519 two-factor authentication bypass was possible via the password reset flow

Bypassing MFA Enforcement via Profile Update Endpoint in JetBrains Hub

In JetBrains Hub before 2026.2.52519 enforced two-factor authentication could be disabled via the profile update endpoint

SMTP Command Injection via Email Verification in JetBrains Hub

In JetBrains Hub before 2026.2.52556 sMTP command injection via email verification was possible

Privilege Escalation via Forged Email Verification in JetBrains Hub

In JetBrains Hub before 2026.2.52519 privilege escalation via forged email verification was possible

Privilege Escalation via Email Authentication Flow in JetBrains Hub

In JetBrains Hub before 2026.2.52556 privilege escalation was possible by changing email authentication details during the verification flow

Read‑Only Users Can Modify Authentication Module Group Mappings Without Proper Authorization

In JetBrains Hub before 2026.2.52519 missing authorisation allowed users with read-only access to modify auth module group mappings

Information Disclosure via User Search Queries in JetBrains Hub

In JetBrains Hub before 2026.2.52519 information disclosure via user search queries was possible

Unauthorized Email Sending via Trusted Address

In JetBrains Hub before 2026.2.52366 missing authorisation allowed authenticated users to send arbitrary emails from the server's trusted address

Unauthenticated Service Registration Grants Superuser Privileges in JetBrains Hub

In JetBrains Hub before 2026.2.52442 an unauthenticated attacker could register a trusted service and gain superuser privileges

Authentication Bypass via Direct Database Access Granting Administrative Access

In JetBrains Hub before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 authentication bypass via direct database access leading to administrative access was possible

Privilege Escalation via Authentication Detail Attachment in JetBrains Hub

In JetBrains Hub before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 privilege escalation by attaching authentication details to accounts was possible

Predictable Restore Codes Allow Account Takeover in JetBrains Hub

In JetBrains Hub before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 account takeover via predictable restore codes was possible

Authentication Bypass Allowing Administrative Actions in JetBrains Hub

In JetBrains Hub before 2025.3.119807 authentication bypass allowing administrative actions was possible

Authentication Bypass via Account Mismatch in JetBrains Hub

In JetBrains Hub before 2026.1 possible on sign-in account mismatch with non-SSO auth and 2FA disabled

In JetBrains Hub before 2025.3.104432 information disclosure was possible via the Users API

In JetBrains Hub before 2025.3.104992 a race condition allowed bypass of the user limit via invitations

In JetBrains Hub before 2025.3.104432 a race condition allowed bypass of the Agent-user limit

In JetBrains Hub before 2022.3.15181 Throttling was missed when sending emails to a particular email address

In JetBrains Hub before 2022.3.15573, 2022.2.15572, 2022.1.15583 reflected XSS in dashboards was possible

In JetBrains Hub before 2023.1.15725 SSRF protection in Auth Module integration was missing