CVE-2026-56141: JetBrains Hub: account takeover via predictable restore codes (CWE-338)
CVE-2026-56141 affects JetBrains Hub builds in several release branches, where predictable restore codes could allow account takeover. The CNA scores it as critical (CVSS v3.1 base score 9.8), and the record lists fixed boundaries for each branch. No confirmed exploitation appears in the sources consulted.
Overview
CVE-2026-56141 concerns JetBrains Hub. According to the record, restore codes could be predicted, which made account takeover possible. The CNA assigned CWE-338. The record gives no name for that CWE, so the description below is an inference from the identifier: CWE-338 covers the use of a cryptographically weak pseudo-random number generator.
Impact
The CNA scored the issue as critical, with a CVSS v3.1 base score of 9.8. The vector in the record describes a network attack that needs low complexity, no privileges and no user interaction, with high impact on confidentiality, integrity and availability. An account takeover would give an attacker control over the affected user's account in Hub.
Affected products and versions
The record lists the following ranges for JetBrains Hub:
- From 2024.2.33606 up to, but not including, 2024.2.148429
- From 2024.3.44799 up to, but not including, 2024.3.148430
- From 2025.1.62455 up to, but not including, 2025.1.148120
- From 2025.2.86069 up to, but not including, 2025.2.148048
- From 2025.3.104432 up to, but not including, 2025.3.148033
- From 2026.1.12024 up to, but not including, 2026.1.13757
The description names the same boundaries as the versions where the problem was fixed. The record's fixes field is empty, so the vendor advisory is the main source to confirm them.
Exploitation status
The CVE is not listed in the CISA KEV catalog, and the record has no EPSS score. No confirmed exploitation appears in the sources consulted.
Remediation and mitigation
- Upgrade JetBrains Hub to the fixed build for your release branch, as listed above, and check the vendor advisory for current guidance.
- If an upgrade cannot happen immediately, limit network exposure of Hub instances to trusted networks. This is a general defensive measure and is not stated in the record.
- After upgrading, review accounts whose restore codes may have been generated before the fix, and consider regenerating them. This is reasoning from the description, not a vendor instruction.
Detection guidance
- Review authentication and account recovery logs for restore code use that does not match the account owner's normal activity.
- Look for account recovery events from unfamiliar locations or unusual patterns of repeated attempts.
- Correlate Hub logs with identity and access alerts to spot account changes made soon after recovery events.
Limitations of the available information
The record does not include technical details, proof-of-concept material or exploitation timelines, and it does not state how restore codes were generated. The fixes field is empty, so fixed builds come from the description and the affected ranges. The vendor advisory is linked but was not reviewed in full here. Whether earlier versions outside the listed ranges are affected is unknown.
Frequently asked questions
What is the core problem in CVE-2026-56141?
According to the record, restore codes in JetBrains Hub were predictable, which made account takeover possible. The CNA linked the issue to CWE-338.
Is this vulnerability known to be exploited?
It is not listed in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted.
Which versions should I upgrade to?
Upgrade to the fixed build for your release branch: 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430 or 2024.2.148429. Check the vendor advisory to confirm.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.