CVE Intelligence
Analysis AI-assisted

CVE-2026-25848: JetBrains Hub Authentication Bypass (CWE-306)

CVE-2026-25848 is a missing-authentication flaw in JetBrains Hub versions before 2025.3.119807 that allows authentication to be bypassed for administrative actions. NVD scores it 9.8 (CVSS 3.1, critical), while JetBrains as CNA scores it 9.1. The record does not show it in CISA KEV, and no confirmed exploitation appears in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-25848 affects JetBrains Hub before 2025.3.119807. The record describes an authentication bypass that allowed administrative actions. The weakness is classified as CWE-306, Missing Authentication for Critical Function.

Impact

  • Per the record, an attacker could perform administrative actions without valid authentication.
  • NVD rates the base score 9.8 under CVSS 3.1 (critical). JetBrains, as CNA, rates it 9.1 under CVSS 3.1.
  • The confidentiality, integrity and availability impacts are rated high in the NVD vector, which should be read as the scoring basis rather than a verified test result.

Affected products and versions

  • Product: JetBrains Hub.
  • Affected range in the record: versions before 2025.3.119807.
  • The record lists no separate fixed-version entry. The upper bound of the affected range suggests 2025.3.119807 is the first unaffected build, but this is an inference to confirm with the vendor.

Exploitation status

  • The record does not list this CVE in CISA KEV.
  • No confirmed active exploitation appears in the sources consulted. The EPSS data in the record shows a low predicted exploitation probability, but this is a statistical estimate and not evidence of attacks.

Remediation and mitigation

  • Upgrade JetBrains Hub to 2025.3.119807 or a later build, following the vendor advisory at JetBrains issues fixed page.
  • Until patching is complete, restrict network access to Hub administrative interfaces to trusted networks and review recent administrative activity.
  • Verify the installed version against the affected range before and after the update.

Detection guidance

  • Review Hub logs for administrative actions performed by accounts or sessions that cannot be tied to a legitimate login.
  • Monitor for configuration changes, new administrative accounts or changed permissions that were not authorized.
  • Correlate Hub access logs with identity provider records to spot unexpected administrative sessions.

Limitations of the available information

  • The record does not describe the exact conditions, required network position or technical mechanism of the bypass.
  • The record has no separate fixed-version list, so the remediation build is inferred from the affected range.
  • Sources consulted are the NVD and CVE Program entries and the vendor advisory page. Their detail is limited.
  • No exploit details are provided here, by design.

Frequently asked questions

Which JetBrains Hub versions are affected by CVE-2026-25848?

The record lists JetBrains Hub versions before 2025.3.119807 as affected. The record does not list a separate fixed-version entry.

Is CVE-2026-25848 known to be actively exploited?

The record does not list it in CISA KEV, and no confirmed exploitation appears in the sources consulted.

What should administrators do now?

Upgrade JetBrains Hub to 2025.3.119807 or a later build using the vendor advisory, and restrict network access to administrative interfaces until patching is complete.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.