Critical JetBrains Flaws Allow Auth Bypass, Code Execution

Key Takeaways

• JetBrains has addressed a series of critical vulnerabilities in its on-premise products, including Hub, YouTrack, IntelliJ-based IDEs, Kotlin, GoLand, and TeamCity.
• These flaws enable authentication bypass, account takeover, and remote code execution (RCE), severely compromising development and CI/CD environments.
• The most critical issues reside in JetBrains Hub and YouTrack, which could grant attackers administrative control without valid credentials.
• Patches are available for all affected products, and immediate updates are strongly recommended across the entire JetBrains ecosystem.

Critical Flaws Expose JetBrains Ecosystem to Full Compromise

JetBrains has issued urgent security updates to mitigate a collection of critical vulnerabilities impacting its on-premise product suite. These flaws collectively allow for authentication bypass, account takeover, and remote code execution, posing a direct threat to development and continuous integration/continuous deployment (CI/CD) pipelines.

Organizations that delay applying these patches face a significant risk of having their environments compromised. The most severe vulnerabilities are found in JetBrains Hub and YouTrack, core components responsible for identity management and project tracking.

JetBrains Hub and YouTrack Authentication Bypass

In JetBrains Hub, a critical vulnerability (CVE-2024-XXXX, score 9.8 CVSSv3) permits account takeover. This flaw exploits predictable restore codes, allowing attackers to systematically guess recovery tokens and hijack existing user accounts. Another Hub vulnerability (CVE-2024-XXXX, score 8.8 CVSSv3) facilitates privilege escalation by enabling attackers to attach authentication details from other accounts, effectively binding higher-privilege credentials to their own profile.

Even more concerning, multiple Hub vulnerabilities (e.g., CVE-2024-XXXX, score 9.8 CVSSv3) enable authentication bypass through direct database access and a lack of proper checks for administrative actions. This bypasses the application’s security logic, granting attackers full administrative capabilities without requiring any valid credentials. Similarly, YouTrack is affected by a critical authentication bypass (CVE-2024-XXXX, score 9.8 CVSSv3) linked to direct database access, which can lead to an attacker gaining administrative control over the issue-tracking system.

Remote Code Execution Across Development Tools

Beyond these identity-layer issues, JetBrains has fixed several execution‑level vulnerabilities that, when chained with compromised accounts, could lead to a complete environment takeover. Kotlin, for instance, contains an unsafe deserialization vulnerability in its build cache metadata (CVE-2024-XXXX, score 8.1 CVSSv3). This allows specially crafted data to trigger arbitrary code execution during build operations.

GoLand is susceptible to a remote code execution flaw (CVE-2024-XXXX, score 7.8 CVSSv3) originating from untrusted project configurations. This vulnerability permits the execution of attacker-controlled logic simply by opening a malicious project. IntelliJ IDEA suffers from multiple execution vectors, including command injection via filename completion (CVE-2024-XXXX, score 7.2 CVSSv3) and command execution through the guest user account (CVE-2024-XXXX, score 6.5 CVSSv3). Both can be exploited if attackers can influence project content or guest sessions. Additional template-driven bugs further expand the attack surface for injection-based code execution.

A critical TeamCity flaw (CVE-2024-XXXX, score 8.8 CVSSv3) enables remote code execution through manipulated Perforce connection settings, posing a significant risk to the software supply chain. An attacker who first exploits an authentication bypass in Hub or YouTrack and then leverages an RCE vulnerability in TeamCity or an IDE could pivot from a single point of entry to gain full control over builds, artifacts, and deployments.

These vulnerabilities affect recent 2024–2026 release lines, meaning even relatively current on-premise instances remain exposed until the latest security builds are applied. Multi-tenant or shared JetBrains deployments face heightened risks of cross-project data exposure and build tampering, particularly in environments where guest access, remote development, or untrusted projects are common.

What You Should Do

• Immediate Patching: Prioritize upgrading JetBrains Hub and YouTrack to their latest available security-patched versions.
• Access Control: Restrict and diligently monitor any direct database access to JetBrains services.
• Strong Authentication: Enforce robust authentication mechanisms, including multi-factor authentication (MFA), across all JetBrains services.
• TeamCity Security: Apply the newest security releases for TeamCity, rotate credentials and tokens used in build configurations, and regularly review build logs and configuration histories for suspicious activity.
• Developer Endpoint Security: Mandate updates to the latest IDE builds on developer workstations, limit the opening of untrusted projects, and revisit existing plugin trust policies.
• Security Audits: Conduct thorough audits of JetBrains logs for anomalous administrative actions and tighten role-based access controls to minimize the impact of future vulnerabilities.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.