JetBrains patches auth bypass and RCE across Hub, YouTrack, IntelliJ and more

A cluster of critical flaws across JetBrains' on-premises tools – Hub, YouTrack, IntelliJ IDEA, Kotlin tooling, and GoLand: chain into authentication bypass, account takeover, and remote code execution.

The sharpest of the bunch: a weak random number generator made Hub's account-restore codes predictable enough to enumerate, scoring CVSS 9.8. A separate, unrelated flaw allows authentication bypass via direct database access, meaning the two issues don't even need to be chained together to be dangerous on their own.

Why this matters beyond the specific CVEs

It's worth remembering what an IDE actually is from a security standpoint: a program that runs with the same privileges as the developer using it, on the same machine that holds your source code, credentials, and often direct access to production systems. Plugin and project trust models in most IDEs are also usually more permissive than people assume by default – opening an unfamiliar repository is not the harmless action it feels like.

Predictable randomness and the developer supply chain

The CVSS 9.8 finding deserves a closer look, because "weak random number generator" undersells it. Account-restore codes only work as a security mechanism if they are impossible to guess; generate them with a predictable source of randomness and an attacker can enumerate candidate codes offline, at their own pace, until one matches – no phishing, no malware, no interaction with the victim at all. Bugs like this are quiet: nothing in a log looks obviously wrong while they are being exploited.

The bigger picture is that developer tooling has become a deliberate target, not collateral damage. Compromising one developer's machine or account can yield source code, signing keys, cloud credentials, and CI/CD access in a single step, which is why campaigns aimed specifically at developers, from malicious packages to trojanized example projects, have kept increasing year over year. On-prem tools like Hub and YouTrack concentrate that risk further: they sit at the center of authentication and issue tracking for entire engineering organizations, so an auth bypass there is not one lost account – it is the directory.

What to do now

• Patch every JetBrains on-prem product you run, not just the ones named in this specific disclosure – the underlying weak-RNG and auth-bypass classes of bug tend to recur across a vendor's product line.
• If you run Hub for account management, rotate any account-restore codes that may have been issued before the patch.
• Until you've confirmed patched status, be more conservative than usual about opening untrusted repositories or projects in any JetBrains IDE.

Frequently asked questions