{"id":"CVE-2026-123297","kind":"vulnerability","aliases":["CVE-2026-123297"],"related":[],"title":"JetBrains Hub: password reset flow let attackers skip two-factor login","description":"In JetBrains Hub before 2026.2.52519 two-factor authentication bypass was possible via the password reset flow","summary":"In JetBrains Hub before 2026.2.52519, the password reset flow could be abused to bypass two-factor authentication. An attacker who can start a reset could get into an account without the second factor.","severity":"medium","cvss":6.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["authentication","jetbrains-hub","other","self-hosted"],"not_affected_if":["hub-2026.2.52519-or-later","no-hub-deployed"],"how_to_check":"- Check the installed Hub version in the Hub admin panel or with the version shown on the Hub login page; compare it with `2026.2.52519`","fix":"- JetBrains Hub: move to `2026.2.52519` or later","status":"open","published_at":"2026-11-06T11:17:08+00:00","first_seen_at":"2026-11-06T11:41:25+00:00","triaged_at":"2026-11-06T11:42:14+00:00","updated_at":"2026-11-06T11:42:14+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-11-06T11:42:14Z","model":"claude-haiku-5-5","output":{"fix":"- JetBrains Hub: move to `2026.2.52519` or later","reach":"internet","title":"JetBrains Hub: password reset flow let attackers skip two-factor login","impact":"high","summary":"In JetBrains Hub before 2026.2.52519, the password reset flow could be abused to bypass two-factor authentication. An attacker who can start a reset could get into an account without the second factor.","audience":"businesses","category":"other","nicknames":[],"who_cares":["jetbrains-hub","self-hosted","authentication"],"confidence":0.5,"fix_status":"available","needs_auth":"unknown","worst_case":"attacker logs into accounts without second factor","analyst_note":"Check the JetBrains Hub release notes or security advisory to confirm the fixed version and the exact trigger conditions.","how_to_check":"- Check the installed Hub version in the Hub admin panel or with the version shown on the Hub login page; compare it with `2026.2.52519`\n- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["hub-2026.2.52519-or-later","no-hub-deployed"],"who_is_affected":"Teams that run a self-hosted JetBrains Hub instance before 2026.2.52519 with two-factor authentication enabled are exposed. Hub instances already on 2026.2.52519 or later, and products that do not use Hub, are not affected. The sources do not say which reset configurations are needed to trigger it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000688,"input_tokens":4166,"output_tokens":543,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-123297':15A,18A '-2026':14A,17A '2026.2.52519':31B,65C 'abus':38B 'account':56B 'attack':7A,46B 'authent':19B,44B,69C 'bypass':40B,70C 'could':36B,52B 'cve':13A,16A 'factor':11A,43B,60B,68C 'flow':5A,35B,77C 'get':53B 'host':26B 'hub':2A,22B,29B,63C 'jetbrain':1A,21B,28B,62C 'jetbrains-hub':20B 'let':6A 'login':12A 'password':3A,33B,75C 'possibl':72C 'reset':4A,34B,51B,76C 'second':59B 'self':25B 'self-host':24B 'skip':8A 'start':49B 'two':10A,42B,67C 'two-factor':9A,41B,66C 'via':73C 'without':57B","nicknames":[],"mitigations":[],"who_affected":"Teams that run a self-hosted JetBrains Hub instance before 2026.2.52519 with two-factor authentication enabled are exposed. Hub instances already on 2026.2.52519 or later, and products that do not use Hub, are not affected. The sources do not say which reset configurations are needed to trigger it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["authentication","jetbrainshub","medium","other","selfhosted"],"campaign_type":null,"search_a":"'-123297':15A,18A '-2026':14A,17A 'attack':7A 'cve':13A,16A 'factor':11A 'flow':5A 'hub':2A 'jetbrain':1A 'let':6A 'login':12A 'password':3A 'reset':4A 'skip':8A 'two':10A 'two-factor':9A","search_b":"'2026.2.52519':31B 'abus':38B 'account':56B 'attack':46B 'authent':19B,44B 'bypass':40B 'could':36B,52B 'factor':43B,60B 'flow':35B 'get':53B 'host':26B 'hub':22B,29B 'jetbrain':21B,28B 'jetbrains-hub':20B 'password':33B 'reset':34B,51B 'second':59B 'self':25B 'self-host':24B 'start':49B 'two':42B 'two-factor':41B 'without':57B","search_c":"'2026.2.52519':65C 'authent':69C 'bypass':70C 'factor':68C 'flow':77C 'hub':63C 'jetbrain':62C 'password':75C 'possibl':72C 'reset':76C 'two':67C 'two-factor':66C 'via':73C","first_public_at":"2026-11-06T11:17:08+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","cvss_by":"cve@jetbrains.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123297","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123297","severity":null,"published_at":"2026-11-06T11:17:08+00:00","modified_at":"2026-11-06T11:17:08+00:00","first_seen_at":"2026-11-06T11:41:25+00:00","fetched_at":"2026-11-06T11:41:25+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}