Description

In JetBrains Datalore before 2026.4 missing expiration validation of account tokens allowed a new authenticated session

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.4",
  "pubDate": "2026-11-06T11:17:06.520Z",
  "pubdate": "2026-11-06T11:17:06.520Z",
  "executiveSummary": "A critical session management vulnerability exists in JetBrains Datalore versions prior to 2026.4 due to insufficient validation of account tokens.\nThe vulnerability allows for the improper handling of expired account tokens, which fail to terminate existing authenticated sessions or prevent the initialization of new ones.\nThis flaw impacts session integrity and authentication enforcement within the Datalore platform.\nAn attacker possessing an expired token can bypass authentication protocols to establish a new, valid authenticated session.\nThe risk implication is significant as it facilitates unauthorized access to the application, potentially leading to data exposure, unauthorized user actions, and persistent access to the victim's account.\nSuccessful exploitation requires the attacker to obtain a previously valid token; however, the lack of server-side expiration validation removes the need for active session management, lowering the barrier for unauthorized session persistence.",
  "technicalDetails": "The root cause of this vulnerability is a failure in the Datalore authentication service to perform stateful validation of account tokens against an expiration policy upon session initiation requests. In typical session management architectures, a token should be validated against a revocation list or an expiration timestamp stored in a secure backend database or cache. In affected versions of Datalore, the system performs an incomplete check, effectively treating expired tokens as valid credentials for establishing new sessions.\nThe attack flow begins when an attacker acquires a victim's account token—potentially through interception, log exposure, or other side-channel leaks. Despite the token's legitimate expiration, the application logic responsible for verifying session requests does not trigger an 'expired' status or reject the session handshake. When the attacker presents this token to the Datalore authentication interface, the backend server processes the authentication request as if the token were current.\nThe vulnerable component resides within the authentication and session management subsystem of Datalore. By failing to enforce a 'Time-to-Live' (TTL) or a definitive 'not-after' date during the handshake phase, the platform maintains a logical flaw where the server trusts a cryptographically valid but chronologically expired token. This behavior violates the fundamental security principle of session non-persistence.\nExploitation does not require active server-side interaction to refresh the token, as the vulnerability resides in the handshake verification process itself. Once the server accepts the expired token, it initializes a new, fully authenticated session for the attacker, mapped to the identity associated with that token. The attacker then assumes the identity and privileges of the victim user.\nThe post-exploitation impact includes the ability to view, modify, or delete data within the user's Datalore workspace. Because the session is treated as legitimate by the application, any actions performed by the attacker are logged under the victim's account, potentially complicating forensic efforts and incident response. The exposure is global, provided the attacker can reach the Datalore authentication endpoint over the network."
}