In JetBrains Hub before 2025.3.119807 authentication bypass allowing administrative actions was possible
The vulnerability is classified as CWE-306 (Missing Authentication for Critical Function), which means that certain administrative functions or endpoints in JetBrains Hub did not require proper authentication before execution. A remote attacker, without providing login credentials, could invoke critical operations reserved for administrators. The network attack vector (AV:N), no complexity requirements (AC:L), no privilege requirements (PR:N), and no user interaction requirements (UI:N) make this vulnerability particularly dangerous.
An unauthenticated attacker can perform privileged administrative actions, leading to high risk of breach of confidentiality and integrity of data managed by JetBrains Hub, including potential takeover of user and permission management.
JetBrains Hub should be updated immediately to version 2025.3.119807 or later. Details are available on the vendor's website: https://www.jetbrains.com/privacy-security/issues-fixed/
JetBrains Hub in all versions prior to 2025.3.119807
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:NJetbrains Hub
APPJetbrains< 2025.3.119807
Related vulnerabilities
JetBrains Hub — privilege escalation przez dołączanie danych uwierzytelniających do kont
JetBrains Hub — pominięcie uwierzytelnienia przez bezpośredni dostęp do bazy danych
JetBrains Hub — przejęcie konta przez przewidywalne kody przywracania
Blind SSRF w JetBrains Hub — nieautoryzowany dostęp do zasobów wewnętrznych
Przejęcie żądania SAML w JetBrains Hub (przed wersją 2022.1.14434)