Description

In JetBrains YouTrack before 2026.2.18634 the generic VCS webhook handler failed open when its secret was blank

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.7",
  "pubDate": "2026-09-07T17:17:26.830Z",
  "pubdate": "2026-09-07T17:17:26.830Z",
  "executiveSummary": "JetBrains YouTrack versions prior to 2026.2.18634 contain a critical security vulnerability within the generic VCS webhook handler. The flaw involves an improper authentication implementation where the system fails to enforce security validation when a webhook secret is left blank or unconfigured.\nThis vulnerability is categorized as an authentication bypass or security misconfiguration. By exploiting this oversight, an unauthenticated remote attacker can trigger webhook actions without providing the required cryptographic signature or secret token, effectively bypassing the integrity and identity verification mechanisms intended to secure the webhook endpoint.\nThe risk implication is significant as it allows unauthorized external entities to interact with the VCS integration logic. Successful exploitation does not require prior authentication or privileged access, relying solely on the attacker's ability to reach the webhook endpoint and submit requests that the application incorrectly treats as authorized due to the missing secret configuration.\nOrganizations using affected versions of YouTrack are susceptible to unauthorized state changes or data processing triggered by external actors. Immediate patching to version 2026.2.18634 or later is required to enforce strict authentication checks.",
  "technicalDetails": "The vulnerability resides within the generic VCS webhook handler component of JetBrains YouTrack. The core issue is a failure-open logic flaw triggered during the authentication handshake process. In the affected versions, the application logic evaluates the presence and validity of the VCS webhook secret; however, when the administrator leaves the secret field blank or null, the handler defaults to an unauthenticated state rather than enforcing a mandatory rejection of the incoming request.\nDuring a standard webhook exchange, the sender (e.g., a version control system like GitHub or GitLab) typically sends a payload accompanied by a hashed signature derived from the configured secret. The YouTrack handler is designed to verify this signature against the locally stored secret to confirm authenticity. When the secret is null, the verification logic fails to perform the cryptographic comparison, incorrectly assuming the request is valid.\nThe attack flow proceeds as follows: 1) The attacker identifies the publicly accessible VCS webhook endpoint associated with the YouTrack instance. 2) The attacker crafts a malicious HTTP POST request that mimics the expected VCS webhook payload structure. 3) Because the secret is blank, the YouTrack handler bypasses the signature verification check. 4) The application processes the forged request as a legitimate event, triggering internal VCS integration logic such as issue updates, status changes, or repository synchronization tasks.\nThis vulnerability allows for unauthorized command and control over VCS-related processes within YouTrack. Since the endpoint is exposed over the network, it is susceptible to remote exploitation without any prerequisite interaction with the target's internal session management or user directory. The impact is limited to the functionality of the VCS webhook itself, but it effectively undermines the integrity of automated CI/CD workflows and project tracking updates that rely on the webhook integration. Post-exploitation, an attacker can manipulate issue states, inject false metadata into project tickets, or otherwise influence the automation pipeline by supplying arbitrary payloads that the system trusts implicitly due to the failure-open authentication logic."
}