JetBrains YouTrack: Account takeover via replayed notification signature

Summary

JetBrains YouTrack before 2026.2.19197 contains an incorrect authorization flaw (CWE-863). An attacker can replay a notification signature to take over another user's account. Exploitation requires network access to the YouTrack instance but no privileges and no user interaction, according to the NVD and third-party data. Whether administrator accounts are reachable is not stated in the sources.

Affected

• JetBrains YouTrack versions before 2026.2.19197 (self-hosted and cloud, per vendor range 0 to < 2026.2.19197)
• CVSS score and NVD status are not yet confirmed; sources differ (9.8 provided; 8.9 reported by a third party)

Fixed in

• Upgrade to YouTrack 2026.2.19197 or later
• Whether older release lines (2025.3, 2026.1) received separate backport builds is unknown.

Workaround

• Unknown. No vendor-published workaround found.
• As a general measure, restrict access to YouTrack to VPN or known networks and remove direct internet exposure where possible.

Exploitation

• No evidence of exploitation in the wild found.
• Not listed in CISA's Known Exploited Vulnerabilities catalog.
• CISA SSVC: Exploitation none, Automatable no, Technical Impact total.
• No public proof-of-concept found for this CVE.

Our recommendation

• Inventory all YouTrack instances, including self-hosted and Docker, with exact build numbers.
• Upgrade self-hosted instances to 2026.2.19197 or later, or to the latest build of your release line.
• Until patched, restrict access to VPN or known networks.
• Review logins and account changes for anomalies, and force password resets and re-authentication for administrators after upgrading.
• Verify the CVSS score and NVD status on the NVD page before reporting severity.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• JetBrains Fixed Security Issues www.jetbrains.com
• OpenCVE CVE-2026-100277 app.opencve.io
• Threat Radar CVE-2026-100277 radar.offseq.com
• Strix CVE-2026-100277 www.strix.ai
• CISA ADP Vulnrichment via HOL hol.org

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 21:48.