CVE-2026-25848CWE-306

In JetBrains Hub before 2025.3.119807 authentication bypass allowing administrative actions was possible

Critical · published February 9, 2026

CVSS v3.1
9.1
EPSS
1%
Percentile
50.6
In the wild
Unconfirmed
What it is

🚨 A sneaky authentication bypass in JetBrains Hub could let anyone wield administrative powers without breaking a sweat! 🔥 Think of it as a hotel where anyone can check in as the manager without showing ID — all it takes is the right know-how! 🏨 If exploited, malicious actors could perform administrative actions, potentially wreaking havoc on your projects, data, and team collaboration. Just imagine an unauthorized user accessing sensitive information or altering configurations — absolutely devastating!

Put simply

Think of it as a hotel where anyone can check in as the manager without showing ID — all it takes is the right know-how! 🏨 This vulnerability allows attackers to bypass authentication in JetBrains Hub versions before 2025.3.119807, enabling them to perform admin-level actions without proper credentials.

What to do

If exploited, malicious actors could perform administrative actions, potentially wreaking havoc on your projects, data, and team collaboration. Just imagine an unauthorized user accessing sensitive information or altering configurations — absolutely devastating! Immediate action is crucial! Upgrade JetBrains Hub to version 2025.3.119807 or later to close this gap. Review your user access controls and ensure that only authorized personnel can perform sensitive operations. 🛡️ You've got this! By following these steps, you're well on your way to securing your environment. ✨

The record
Technical detail
CVSS v3.1
9.1 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00651 · 50.6th percentile
Weakness
CWE-306 · Missing Authentication for Critical Function
Published
2026-02-09T10:39Z
EPSS history
Timeline
  • 09 FEB 10:39Z
    In JetBrains Hub before 2025.3.119807 authentication bypass allowing administrative actions was possible
    cvelistv5