Description

In JetBrains Hub before 2026.2.52519 two-factor authentication bypass was possible via the password reset flow

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.8",
  "pubDate": "2026-11-06T11:17:08.530Z",
  "pubdate": "2026-11-06T11:17:08.530Z",
  "executiveSummary": "A critical authentication vulnerability exists in JetBrains Hub prior to version 2026.2.52519, allowing unauthorized actors to circumvent two-factor authentication (2FA) controls.\nThe vulnerability resides within the password reset implementation, where the verification logic fails to properly enforce or validate 2FA requirements during the recovery flow.\nSuccessful exploitation permits an attacker to compromise user accounts protected by 2FA without possessing the second-factor authentication token or device.\nThis flaw represents a significant security risk, as it effectively nullifies the primary layer of defense for privileged and standard accounts alike.\nAttackers can leverage this bypass to achieve full account takeover, potentially leading to unauthorized access to sensitive administrative interfaces, project data, and integrated services connected to the JetBrains Hub instance.\nThe attack requires access to the password reset mechanism but does not necessitate existing authentication to the target account, significantly increasing the potential attack surface.",
  "technicalDetails": "The vulnerability is located within the credential recovery workflow of JetBrains Hub. In affected versions, the application fails to maintain the state of the 2FA requirement throughout the entire password reset sequence.\nTypically, a robust password reset flow must ensure that if a user has 2FA enabled, the recovery process requires successful verification of the second factor before allowing the modification of credentials or the generation of a new authentication session. In this instance, the logic flaw exists where the application provides a path to finalize the password reset without transitioning the authentication state through the required multi-factor verification check.\nThe exploitation flow begins with an attacker initiating a password reset request for a target account. Upon receiving the reset token or following the recovery link, the attacker interacts with the password reset endpoint. Due to the failure in the backend validation logic, the application skips the secondary authentication challenge. Instead, the system validates the recovery token and proceeds to update the user's password directly.\nBy bypassing the 2FA enforcement point, the attacker effectively renders the second-factor security control moot. Once the password is reset, the attacker can authenticate as the victim using the new credentials. Since the 2FA verification was skipped during the reset, the subsequent authentication session is treated as authenticated, granting the attacker full access to the account.\nThe root cause is a deficiency in the session state management and the coupling of password reset workflows with the multi-factor authentication enforcement handler. The component responsible for processing password changes fails to verify the status of the 2FA flag on the user account before committing the password update to the database.\nThis vulnerability is reachable remotely over the network, does not require any specific user privileges prior to the password reset initiation, and does not require the attacker to have the victim's secondary authentication device. The impact is a total bypass of the organization's multi-factor authentication security policy."
}