Is CVE-2026-123295 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-123295 being exploited in the wild.

How severe is CVE-2026-123295?

High severity, with a CVSS score of 8.1, published 6 November 2026.

Which products and versions are affected?

Jetbrains Hub before 2026.2.52519.

Is there a fix for CVE-2026-123295?

Yes: fixed in 2026.2.52519. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-123295 attacked?

It is attacked over the network.

Am I affected by CVE-2026-123295?

Check whether you run Jetbrains Hub at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-123295: JetBrains Hub two-factor authentication bypass in profile update

CVE-2026-123295 · Severity: high · CVSS 8.1 · Published 2026-11-06

JetBrains Hub is a centralized platform for team collaboration and authentication management. An attacker who gains access to a user account can disable mandatory two-factor authentication through the profile update endpoint, allowing them to maintain account access without additional verification. This bypasses a critical security control intended to prevent unauthorized account takeover.

Technologies: Jetbrains Hub. Vendors: Jetbrains.

Quick answers

Is CVE-2026-123295 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-123295 being exploited in the wild.
How severe is CVE-2026-123295?: High severity, with a CVSS score of 8.1, published 6 November 2026.
Which products and versions are affected?: Jetbrains Hub before 2026.2.52519.
Is there a fix for CVE-2026-123295?: Yes: fixed in 2026.2.52519. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-123295 attacked?: It is attacked over the network.
Am I affected by CVE-2026-123295?: Check whether you run Jetbrains Hub at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 2026.2.52519

Technical details

The vulnerability is an authentication bypass in the profile update endpoint that allows disabling enforced two-factor authentication. An authenticated attacker can modify user profile settings to turn off 2FA protection that should be non-negotiable at the organizational level. The flaw affects JetBrains Hub versions before 2026.2.52519 and requires valid account credentials to exploit.

Affected products

JetBrains Hub before 2026.2.52519

Timeline

2026-11-06: disclosed
2026-11-06: patched: Fixed in version 2026.2.52519

References

https://www.jetbrains.com/privacy-security/issues-fixed/

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.