Critical · 9.8 CVE-2026-56141 EUVD-2026-38006GHSA-cq2r-w6jr-x35w

In JetBrains Hub before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 account takeover via predic…

Published Jun 19, 2026 · Updated Jun 24, 2026 · Assigned by JetBrains

Description

In JetBrains Hub before 2026.1.13757,
2025.3.148033,
2025.2.148048,
2025.1.148120,
2024.3.148430,
2024.2.148429 account takeover via predictable restore codes was possible

Affected products

Vendor	Product	Affected	Fixed
JetBrains	Hub	< 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429	2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429

References

https://www.jetbrains.com/privacy-security/issues-fixed/