CVE-2026-123295 · Other
NO FIX YET · SEE WHAT TO DO
JetBrains Hub before 2026.2.52519 lets a user disable two-factor authentication that the administrator has enforced, by sending a request to the profile update endpoint. An attacker with a valid account can then sign in without the second factor.
first public Nov 6, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Teams that run a self-hosted JetBrains Hub instance with enforced two-factor authentication. Exposure depends on an account being able to reach the profile update endpoint; instances on a fixed version or without enforced 2FA are not affected by this flaw.
Not affected if fixed-version, no-enforced-2fa
Who cares authentication, jetbrains-hub, self-hosted
2026.2.52519 are in scope.2026.2.52519 or later.In JetBrains Hub before 2026.2.52519 enforced two-factor authentication could be disabled via the profile update endpoint
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.