# Jetbrains Hub vulnerabilities Source: https://junglewise.ai/threats/technologies/hub Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 12 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/hub.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 11 vulnerabilities in Jetbrains Hub: 5 in the last 7 days and 7 in the last 90 days, 5 of them critical and 0 exploited in the wild. The most recent, CVE-2026-123298, was published on 6 November 2026. 5 vulnerabilities in the last four weeks, up 400% on the four before (1). 1 critical against 0. ## Counts - Last 7 days: 5 - Last 30 days: 5 - Last 90 days: 7 - All time: 11 (5 critical, 0 exploited in the wild) ## About Jetbrains Hub A centralized user management and authorization tool that provides single sign-on across JetBrains team tools. ## Latest Jetbrains Hub vulnerabilities - [CVE-2026-123298: JetBrains Hub SMTP command injection in email verification](https://junglewise.ai/threats/cve-2026-123298-in-jetbrains-hub-before-2026-2-52556-smtp-command-injection-via) (medium, CVSS 5, published 6 Nov 2026) - [CVE-2026-123297: JetBrains Hub two-factor authentication bypass in password reset](https://junglewise.ai/threats/cve-2026-123297-in-jetbrains-hub-before-2026-2-52519-two-factor-authentication) (medium, CVSS 6.8, published 6 Nov 2026) - [CVE-2026-123296: JetBrains Hub privilege escalation via forged email verification](https://junglewise.ai/threats/cve-2026-123296-in-jetbrains-hub-before-2026-2-52519-privilege-escalation-via) (high, CVSS 7.5, published 6 Nov 2026) - [CVE-2026-123295: JetBrains Hub two-factor authentication bypass in profile update](https://junglewise.ai/threats/cve-2026-123295-in-jetbrains-hub-before-2026-2-52519-enforced-two-factor) (high, CVSS 8.1, published 6 Nov 2026) - [CVE-2026-123294: JetBrains Hub privilege escalation in email verification](https://junglewise.ai/threats/cve-2026-123294-in-jetbrains-hub-before-2026-2-52556-privilege-escalation-was) (critical, CVSS 9.6, published 6 Nov 2026) - [CVE-2026-100266: JetBrains Hub authorization bypass in email sending](https://junglewise.ai/threats/cve-2026-100266-in-jetbrains-hub-before-2026-2-52366-missing-authorisation) (high, CVSS 7.7, published 30 Sep 2026) - [CVE-2026-86480: JetBrains Hub authentication bypass in trusted service registration](https://junglewise.ai/threats/cve-2026-86480-jetbrains-hub-authentication-bypass-in-trusted-service) (critical, CVSS 9.8, published 7 Sep 2026) - [CVE-2026-73561: anephenix hub unauthenticated WebSocket RPC resource exhaustion](https://junglewise.ai/threats/cve-2026-73561-anephenix-hub-unauthenticated-websocket-rpc-resource-exhaustion) (high, CVSS 7.5, published 13 Aug 2026) - [CVE-2026-56142: JetBrains Hub privilege escalation via authentication detail attachment](https://junglewise.ai/threats/cve-2026-56142-jetbrains-hub-privilege-escalation-via-authentication-detail) (critical, CVSS 9.9, published 19 Jun 2026) - [CVE-2026-56141: JetBrains Hub account takeover via predictable restore codes](https://junglewise.ai/threats/cve-2026-56141-jetbrains-hub-account-takeover-via-predictable-restore-codes) (critical, CVSS 9.8, published 19 Jun 2026) - [CVE-2026-50242: JetBrains Hub authentication bypass leading to administrative access](https://junglewise.ai/threats/cve-2026-50242-jetbrains-hub-authentication-bypass-leading-to-administrative) (critical, CVSS 10, published 19 Jun 2026) ## Most severe Jetbrains Hub vulnerabilities - [CVE-2026-50242: JetBrains Hub authentication bypass leading to administrative access](https://junglewise.ai/threats/cve-2026-50242-jetbrains-hub-authentication-bypass-leading-to-administrative) (critical, CVSS 10, published 19 Jun 2026) - [CVE-2026-56142: JetBrains Hub privilege escalation via authentication detail attachment](https://junglewise.ai/threats/cve-2026-56142-jetbrains-hub-privilege-escalation-via-authentication-detail) (critical, CVSS 9.9, published 19 Jun 2026) - [CVE-2026-86480: JetBrains Hub authentication bypass in trusted service registration](https://junglewise.ai/threats/cve-2026-86480-jetbrains-hub-authentication-bypass-in-trusted-service) (critical, CVSS 9.8, published 7 Sep 2026) - [CVE-2026-56141: JetBrains Hub account takeover via predictable restore codes](https://junglewise.ai/threats/cve-2026-56141-jetbrains-hub-account-takeover-via-predictable-restore-codes) (critical, CVSS 9.8, published 19 Jun 2026) - [CVE-2026-123294: JetBrains Hub privilege escalation in email verification](https://junglewise.ai/threats/cve-2026-123294-in-jetbrains-hub-before-2026-2-52556-privilege-escalation-was) (critical, CVSS 9.6, published 6 Nov 2026) - [CVE-2026-123295: JetBrains Hub two-factor authentication bypass in profile update](https://junglewise.ai/threats/cve-2026-123295-in-jetbrains-hub-before-2026-2-52519-enforced-two-factor) (high, CVSS 8.1, published 6 Nov 2026) - [CVE-2026-100266: JetBrains Hub authorization bypass in email sending](https://junglewise.ai/threats/cve-2026-100266-in-jetbrains-hub-before-2026-2-52366-missing-authorisation) (high, CVSS 7.7, published 30 Sep 2026) - [CVE-2026-73561: anephenix hub unauthenticated WebSocket RPC resource exhaustion](https://junglewise.ai/threats/cve-2026-73561-anephenix-hub-unauthenticated-websocket-rpc-resource-exhaustion) (high, CVSS 7.5, published 13 Aug 2026) - [CVE-2026-123296: JetBrains Hub privilege escalation via forged email verification](https://junglewise.ai/threats/cve-2026-123296-in-jetbrains-hub-before-2026-2-52519-privilege-escalation-via) (high, CVSS 7.5, published 6 Nov 2026) - [CVE-2026-123297: JetBrains Hub two-factor authentication bypass in password reset](https://junglewise.ai/threats/cve-2026-123297-in-jetbrains-hub-before-2026-2-52519-two-factor-authentication) (medium, CVSS 6.8, published 6 Nov 2026) ## Vulnerabilities per week 5 vulnerabilities in the last four weeks, up 400% on the four before (1). 1 critical against 0. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 1 | 1 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 1 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 5 | 1 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other Jetbrains technologies - [Jetbrains YouTrack](https://junglewise.ai/threats/technologies/youtrack): 83 vulnerabilities - [Jetbrains IntelliJ IDEA](https://junglewise.ai/threats/technologies/intellij-idea): 51 vulnerabilities - [Jetbrains TeamCity](https://junglewise.ai/threats/technologies/teamcity): 34 vulnerabilities - [Jetbrains Datalore](https://junglewise.ai/threats/technologies/datalore): 16 vulnerabilities - [Jetbrains Webstorm](https://junglewise.ai/threats/technologies/webstorm): 8 vulnerabilities - [Jetbrains GoLand](https://junglewise.ai/threats/technologies/goland): 7 vulnerabilities - [Jetbrains PyCharm](https://junglewise.ai/threats/technologies/pycharm): 7 vulnerabilities - [Jetbrains CLion](https://junglewise.ai/threats/technologies/clion): 6 vulnerabilities - [Jetbrains PhpStorm](https://junglewise.ai/threats/technologies/phpstorm): 6 vulnerabilities - [Jetbrains Rider](https://junglewise.ai/threats/technologies/rider): 4 vulnerabilities - [Jetbrains Toolbox App](https://junglewise.ai/threats/technologies/toolbox-app): 4 vulnerabilities - [Jetbrains Junie CLI](https://junglewise.ai/threats/technologies/junie-cli): 3 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Jetbrains Hub vulnerabilities", https://junglewise.ai/threats/technologies/hub, 12 November 2026.