Description

In JetBrains YouTrack before 2025.3.161254, 2026.1.14042 improper authentication in YouTrack Helpdesk allowed unauthenticated account takeover via a self-asserted email address

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-09-07T17:17:25.920Z",
  "pubdate": "2026-09-07T17:17:25.920Z",
  "executiveSummary": "An improper authentication vulnerability exists within the JetBrains YouTrack Helpdesk module, which facilitates unauthorized account takeover.\nThe flaw allows unauthenticated remote attackers to assume the identity of arbitrary users by providing a self-asserted email address during interaction with the Helpdesk interface.\nThis vulnerability affects versions prior to 2025.3.161254 and version 2026.1.14042 of the YouTrack platform.\nThe risk implication is critical, as it bypasses standard identity verification mechanisms, granting attackers unauthorized access to sensitive account data, communication history, and internal workflows without valid credentials.\nSuccessful exploitation requires no prior authentication or administrative privileges, significantly lowering the barrier for entry for malicious actors.\nThe ability to perform account takeover through identity impersonation represents a fundamental breakdown in the application's authentication logic, necessitating immediate remediation via update deployment.",
  "technicalDetails": "The vulnerability resides in the YouTrack Helpdesk component's handling of user identity verification during the request submission or ticket interaction process.\nThe root cause is an insecure authentication check that implicitly trusts the email address supplied by the user within the Helpdesk workflow without performing cryptographic validation or verifying ownership of the provided email identifier.\nThe attack flow initiates when an unauthenticated remote attacker accesses the Helpdesk module. By injecting an arbitrary, target user's email address into the fields processed by the vulnerable component, the attacker forces the application to link the current session or the incoming ticket to the victim's account.\nBecause the application fails to validate the assertion of the identity, the backend logic erroneously authenticates the requester as the owner of the submitted email address. This allows the attacker to hijack the session associated with the victim's account.\nOnce the account takeover is successful, the attacker gains full visibility into the victim's context within YouTrack. This includes access to private tickets, internal comments, historical activity logs, and any sensitive information attached to the hijacked profile.\nThe vulnerable component is explicitly identified as the YouTrack Helpdesk feature. The scope of impact is limited to instances where the Helpdesk module is enabled and exposed. Versions impacted include any build prior to 2025.3.161254 and the specific release version 2026.1.14042.\nExploitation does not require prior knowledge of the victim's credentials or interaction with the victim, as the flaw is inherent to the server-side processing of the self-asserted identity attribute.\nPost-exploitation activities are limited only by the permissions assigned to the hijacked account. If the target is an administrator or a user with elevated access within YouTrack, the attacker may pivot to further malicious activities, such as modifying system configurations, exfiltrating intellectual property, or creating secondary persistence mechanisms within the instance.\nThe failure to verify email ownership represents a critical breakdown in secure session management and authentication architecture, specifically within the input-trust model adopted by the Helpdesk module."
}