JetBrains patches auth bypass and RCE across Hub, YouTrack, IntelliJ and more

A cluster of critical flaws across JetBrains' on-premises tools — Hub, YouTrack, IntelliJ IDEA, Kotlin tooling, and GoLand — chain into authentication bypass, account takeover, and remote code execution.

The sharpest of the bunch: a weak random number generator made Hub's account-restore codes predictable enough to enumerate, scoring CVSS 9.8. A separate, unrelated flaw allows authentication bypass via direct database access, meaning the two issues don't even need to be chained together to be dangerous on their own.

Why this matters beyond the specific CVEs

It's worth remembering what an IDE actually is from a security standpoint: a program that runs with the same privileges as the developer using it, on the same machine that holds your source code, credentials, and often direct access to production systems. Plugin and project trust models in most IDEs are also usually more permissive than people assume by default — opening an unfamiliar repository is not the harmless action it feels like.

What to do now

• Patch every JetBrains on-prem product you run, not just the ones named in this specific disclosure — the underlying weak-RNG and auth-bypass classes of bug tend to recur across a vendor's product line.
• If you run Hub for account management, rotate any account-restore codes that may have been issued before the patch.
• Until you've confirmed patched status, be more conservative than usual about opening untrusted repositories or projects in any JetBrains IDE.