Jetbrains Hub
36 CVEs affecting Jetbrains Hub. Latest disclosed: 2026-06-19. Critical: 8, High: 6.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-50242 | Critical | 10.0 | 2026-06-19 | In JetBrains Hub before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 authentication bypass via direct database acces… |
CVE-2026-56142 | Critical | 9.9 | 2026-06-19 | In JetBrains Hub before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 privilege escalation by attaching authenticatio… |
CVE-2026-56141 | Critical | 9.8 | 2026-06-19 | In JetBrains Hub before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 account takeover via predictable restore codes… |
CVE-2022-25262 | Critical | 9.8 | 2022-02-25 | In JetBrains Hub before 2022.1.14434, SAML request takeover was possible. |
CVE-2021-43183 | Critical | 9.8 | 2021-11-09 | In JetBrains Hub before 2021.1.13690, the authentication throttling mechanism could be bypassed. |
CVE-2021-36209 | Critical | 9.8 | 2021-08-06 | In JetBrains Hub before 2021.1.13389, account takeover was possible during password reset. |
CVE-2026-25848 | Critical | 9.1 | 2026-02-09 | In JetBrains Hub before 2025.3.119807 authentication bypass allowing administrative actions was possible |
CVE-2022-25260 | Critical | 9.1 | 2022-02-25 | JetBrains Hub before 2021.1.14276 was vulnerable to blind Server-Side Request Forgery (SSRF). |
CVE-2022-24327 | High | 7.5 | 2022-02-25 | In JetBrains Hub before 2021.1.13890, integration with JetBrains Account exposed an API key with excessive permissions. |
CVE-2021-43182 | High | 7.5 | 2021-11-09 | In JetBrains Hub before 2021.1.13415, a DoS via user information is possible. |
CVE-2021-43180 | High | 7.5 | 2021-11-09 | In JetBrains Hub before 2021.1.13690, information disclosure via avatar metadata is possible. |
CVE-2021-31901 | High | 7.5 | 2021-05-11 | In JetBrains Hub before 2021.1.13079, two-factor authentication wasn't enabled properly for the All Users group. |
CVE-2020-11691 | High | 7.5 | 2020-04-22 | In JetBrains Hub before 2020.1.12099, content spoofing in the Hub OAuth error message was possible. |
CVE-2019-12847 | High | 7.2 | 2019-07-03 | In JetBrains Hub versions earlier than 2018.4.11298, the audit events for SMTPSettings show a cleartext password to the admin user. It is only relevant in case… |
CVE-2026-32229 | Medium | 6.8 | 2026-03-11 | In JetBrains Hub before 2026.1 possible on sign-in account mismatch with non-SSO auth and 2FA disabled |
CVE-2025-24456 | Medium | 6.7 | 2025-01-21 | In JetBrains Hub before 2024.3.55417 privilege escalation was possible via LDAP authentication mapping |
CVE-2022-24328 | Medium | 6.5 | 2022-02-25 | In JetBrains Hub before 2021.1.13956, an unprivileged user could perform DoS. |
CVE-2021-37540 | Medium | 6.5 | 2021-08-06 | In JetBrains Hub before 2021.1.13262, a potentially insufficient CSP for the Widget deployment feature was used. |
CVE-2021-25759 | Medium | 6.5 | 2021-02-03 | In JetBrains Hub before 2020.1.12629, an authenticated user can delete 2FA settings of any other user. |
CVE-2022-29811 | Medium | 6.1 | 2022-04-28 | In JetBrains Hub before 2022.1.14638 stored XSS via project icon was possible. |