Description

In JetBrains Datalore before 2026.4 account takeover was possible via SSO sign-in to a pre-registered account

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.8",
  "pubDate": "2026-11-06T11:17:06.650Z",
  "pubdate": "2026-11-06T11:17:06.650Z",
  "executiveSummary": "A critical authentication vulnerability exists in JetBrains Datalore versions prior to 2026.4, allowing for unauthorized account takeover via Single Sign-On (SSO) mechanisms.\nThe vulnerability allows an unauthenticated attacker to compromise existing, pre-registered user accounts by exploiting improper validation logic during the SSO sign-in workflow.\nThis flaw facilitates unauthorized access to sensitive user data, workspaces, and computational environments hosted within Datalore, effectively bypassing standard authentication protections.\nSuccessful exploitation requires the attacker to interact with the SSO authentication flow, though it does not necessitate prior knowledge of the victim's credentials.\nThe risk implication is severe, as it permits full account takeover, enabling potential lateral movement, data exfiltration, and unauthorized execution of code within the victim's data science projects.\nOrganizations utilizing affected versions are at high risk of credential harvesting and unauthorized system access and should prioritize immediate remediation.",
  "technicalDetails": "The root cause of this vulnerability lies in an insecure implementation of the SSO authentication handshake within JetBrains Datalore. Specifically, the application failed to sufficiently validate the association between an incoming SSO identity assertion and a pre-registered local user account.\nIn typical SSO implementations, the service provider (Datalore) must verify the identity token returned by the identity provider (IdP). If the verification process does not strictly enforce the mapping of unique identifiers (such as an email address or external unique ID) to the existing account, an attacker can manipulate the authentication assertion to masquerade as an established user.\nThe attack flow proceeds as follows: 1. An attacker identifies a target account email address previously registered in the Datalore instance. 2. During the SSO sign-in process, the attacker triggers an authentication flow that directs the application to process an SSO assertion. 3. Due to the lack of strict validation, the application improperly links the attacker-provided SSO context to the pre-existing, pre-registered account identified in step one. 4. The application logic trusts the malformed or improperly validated assertion as legitimate proof of identity for the existing account holder. 5. The attacker is subsequently granted an authenticated session with the privileges of the victim's account.\nThis vulnerability exploits the 'Account Linking' phase of the SSO integration. The system fails to verify whether the incoming user identity from the IdP is cryptographically bound to the user profile already residing in the Datalore user database. By providing an SSO assertion that claims an identity matching a pre-registered user, the attacker effectively overrides the authentication checks for that specific account.\nThe vulnerable component is the SSO integration module responsible for parsing and validating SAML, OIDC, or similar authentication protocols. The issue persists across all configurations where SSO is enabled for pre-registered users in versions prior to 2026.4.\nThe impact of a successful exploit is complete account takeover. Once authenticated, the attacker inherits the victim's permissions, which typically includes full access to all private notebooks, datasets, connected data sources, and computational secrets. Furthermore, because Datalore environments often contain sensitive API keys and configuration strings, the attacker could pivot from the account compromise to access external infrastructure or cloud provider resources connected through the victim's account."
}