{"id":"CVE-2026-123283","kind":"vulnerability","aliases":["CVE-2026-123283"],"related":[],"title":"JetBrains Datalore: SSO sign-in could take over pre-registered accounts","description":"In JetBrains Datalore before 2026.4 account takeover was possible via SSO sign-in to a pre-registered account","summary":"Before version 2026.4, JetBrains Datalore let an attacker take over an account through SSO sign-in to a pre-registered account. The attacker ends up with access to another user's Datalore account.","severity":"medium","cvss":6.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["datalore","jetbrains","package","sso"],"not_affected_if":["no-sso","version-2026.4-or-later"],"how_to_check":"- Check the installed Datalore version in the product's about or admin screen; the sources do not give the exact location.","fix":"- Datalore: move to `2026.4` or later, per the sources.","status":"open","published_at":"2026-11-06T11:17:06+00:00","first_seen_at":"2026-11-06T11:41:24+00:00","triaged_at":"2026-11-06T11:42:16+00:00","updated_at":"2026-11-06T11:42:16+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-11-06T11:42:16Z","model":"claude-haiku-5-5","output":{"fix":"- Datalore: move to `2026.4` or later, per the sources.","reach":"internet","title":"JetBrains Datalore: SSO sign-in could take over pre-registered accounts","impact":"high","summary":"Before version 2026.4, JetBrains Datalore let an attacker take over an account through SSO sign-in to a pre-registered account. The attacker ends up with access to another user's Datalore account.","audience":"businesses","category":"package","nicknames":[],"who_cares":["datalore","jetbrains","sso"],"confidence":0.5,"fix_status":"available","needs_auth":"no","worst_case":"attacker takes over another user's account","analyst_note":"Confirm whether hosted Datalore is affected and whether the fix is version 2026.4 for all deployments; check the JetBrains advisory.","how_to_check":"- Check the installed Datalore version in the product's about or admin screen; the sources do not give the exact location.\n- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["no-sso","version-2026.4-or-later"],"who_is_affected":"Teams that run Datalore with SSO sign-in enabled and have pre-registered accounts are exposed. The sources do not say whether the hosted service or only self-managed installs are affected, so unknown for the rest.","user_interaction":"unknown","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000661,"input_tokens":4168,"output_tokens":489,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-123283':16A,19A '-2026':15A,18A '2026.4':26B,63C 'access':52B 'account':13A,35B,46B,58B,64C,78C 'anoth':54B 'attack':31B,48B 'could':7A 'cve':14A,17A 'datalor':2A,20B,28B,57B,61C 'end':49B 'jetbrain':1A,21B,27B,60C 'let':29B 'packag':22B 'possibl':67C 'pre':11A,44B,76C 'pre-regist':10A,43B,75C 'regist':12A,45B,77C 'sign':5A,39B,71C 'sign-in':4A,38B,70C 'sso':3A,23B,37B,69C 'take':8A,32B 'takeov':65C 'user':55B 'version':25B 'via':68C","nicknames":[],"mitigations":[],"who_affected":"Teams that run Datalore with SSO sign-in enabled and have pre-registered accounts are exposed. The sources do not say whether the hosted service or only self-managed installs are affected, so unknown for the rest.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["datalore","jetbrains","medium","package","sso"],"campaign_type":null,"search_a":"'-123283':16A,19A '-2026':15A,18A 'account':13A 'could':7A 'cve':14A,17A 'datalor':2A 'jetbrain':1A 'pre':11A 'pre-regist':10A 'regist':12A 'sign':5A 'sign-in':4A 'sso':3A 'take':8A","search_b":"'2026.4':26B 'access':52B 'account':35B,46B,58B 'anoth':54B 'attack':31B,48B 'datalor':20B,28B,57B 'end':49B 'jetbrain':21B,27B 'let':29B 'packag':22B 'pre':44B 'pre-regist':43B 'regist':45B 'sign':39B 'sign-in':38B 'sso':23B,37B 'take':32B 'user':55B 'version':25B","search_c":"'2026.4':63C 'account':64C,78C 'datalor':61C 'jetbrain':60C 'possibl':67C 'pre':76C 'pre-regist':75C 'regist':77C 'sign':71C 'sign-in':70C 'sso':69C 'takeov':65C 'via':68C","first_public_at":"2026-11-06T11:17:06+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","cvss_by":"cve@jetbrains.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123283","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123283","severity":null,"published_at":"2026-11-06T11:17:06+00:00","modified_at":"2026-11-06T11:17:06+00:00","first_seen_at":"2026-11-06T11:41:24+00:00","fetched_at":"2026-11-06T11:41:24+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}