Executive brief
JetBrains YouTrack is an issue tracking and project management system that integrates with code repositories like Bitbucket through webhook notifications. This vulnerability allows an attacker to forge Bitbucket webhook requests by spoofing the originating IP address through HTTP headers, potentially injecting malicious data or triggering unwanted actions in YouTrack without proper authorization from Bitbucket.
Technical details
The vulnerability is an IP spoofing flaw in YouTrack's webhook validation logic for Bitbucket integrations. The application relies on HTTP headers (such as X-Forwarded-For or similar) to verify the source IP address of incoming webhooks, rather than properly validating cryptographic signatures or using a secure header validation mechanism. An unauthenticated attacker with network access can craft HTTP requests with spoofed IP headers to impersonate Bitbucket webhook sources. This allows forging webhook events that YouTrack processes as legitimate Bitbucket notifications. The fix was implemented in YouTrack version 2026.2.18634 or later.
Affected products
- JetBrains YouTrack before 2026.2.18634
Timeline
- 2026-09-07: disclosed