Description

In JetBrains Hub before 2026.2.52519 enforced two-factor authentication could be disabled via the profile update endpoint

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-11-06T11:17:08.273Z",
  "pubdate": "2026-11-06T11:17:08.273Z",
  "executiveSummary": "A critical security flaw in JetBrains Hub allows an authenticated user to disable enforced two-factor authentication (2FA).\nThe vulnerability resides in the profile update endpoint, which fails to adequately validate or enforce security policies during configuration changes.\nAffected versions include all instances of JetBrains Hub prior to 2026.2.52519.\nThe primary impact is the complete bypass of multi-factor authentication (MFA) requirements, significantly increasing the risk of account takeover if primary credentials are compromised.\nAn attacker with valid user credentials can exploit this issue by submitting a specifically crafted request to the vulnerable endpoint, effectively lowering the security posture of their account.\nThis flaw undermines administrative security policies that mandate 2FA usage across the organization, potentially facilitating unauthorized lateral movement or persistent access for malicious actors.",
  "technicalDetails": "The root cause of the vulnerability is an insufficient access control check within the profile management logic of JetBrains Hub. Specifically, the profile update endpoint improperly processes requests that modify authentication security settings, failing to verify whether the specific user is restricted by administrative policies regarding 2FA enforcement.\nUnder normal operating conditions, an administrative policy requiring 2FA should block any attempt to modify or disable the MFA status of an account. However, in vulnerable versions of JetBrains Hub, the backend API does not enforce this constraint when processing requests via the profile update mechanism.\nExploitation follows a straightforward vector: An attacker with valid credentials initiates an HTTP request to the profile update API endpoint. By manipulating the parameters associated with the user's security settings—specifically those controlling the 2FA state—the attacker can force the application to disable the mandatory 2FA requirement for the account.\nThe vulnerable component is the user profile management module which handles configuration persistence. Because this module performs the update operation without cross-referencing global security mandates, the request succeeds, and the internal database reflects the disabled 2FA status immediately.\nNo complex client-side script execution or multi-stage exploit chain is required; a simple request modification is sufficient. Consequently, the attack does not require elevated administrative privileges, only standard user access, provided the user has initial login capabilities.\nPost-exploitation, the victim account is no longer protected by the secondary authentication layer. This drastically increases the probability of successful account hijacking via credential stuffing, password spraying, or phishing attacks. In an environment where 2FA is a core component of the identity and access management (IAM) framework, this bypass represents a complete collapse of the authentication security boundary for the targeted account, granting the attacker persistent, single-factor access to the platform."
}