CVE-2026-28194: JetBrains TeamCity Open Redirect Vulnerability

CVE-2026-28194 Overview

CVE-2026-28194 is an open redirect vulnerability discovered in JetBrains TeamCity, a popular continuous integration and continuous delivery (CI/CD) server. The vulnerability exists in the React project creation flow, allowing attackers to craft malicious URLs that redirect users to arbitrary external websites. This type of vulnerability is classified under CWE-601 (URL Redirection to Untrusted Site, also known as 'Open Redirect').

Open redirect vulnerabilities are particularly dangerous in enterprise CI/CD environments like TeamCity because they can be leveraged for phishing attacks, credential theft, and as a stepping stone for more sophisticated attack chains against development infrastructure.

Critical Impact

Attackers can exploit this open redirect to craft convincing phishing URLs using the trusted TeamCity domain, potentially leading to credential theft or malware distribution targeting developers and DevOps teams.

Affected Products

• JetBrains TeamCity versions prior to 2025.11.3

Discovery Timeline

• 2026-02-25 - CVE-2026-28194 published to NVD
• 2026-02-25 - Last updated in NVD database

Technical Details for CVE-2026-28194

Vulnerability Analysis

This open redirect vulnerability occurs within the React project creation workflow of JetBrains TeamCity. The application fails to properly validate or sanitize URL parameters that control redirect destinations during the project setup process. When a user interacts with the project creation interface, the application accepts URL parameters that can redirect users to external, potentially malicious websites.

The vulnerability requires user interaction to exploit, as victims must click on a crafted link. However, because the initial URL points to a legitimate TeamCity server, users may trust the link and follow it without suspicion. The scope of the vulnerability is changed (marked as "Changed" in CVSS), meaning the vulnerable component impacts resources beyond its security scope.

Root Cause

The root cause of CVE-2026-28194 is insufficient input validation in the URL redirect logic within the React project creation flow. The application accepts user-controllable input for redirect destinations without properly verifying that the target URL belongs to the same domain or an allowlisted set of trusted domains. This violates the security principle of validating all user input, particularly for security-sensitive operations like URL redirections.

Attack Vector

The attack is network-based and requires an attacker to craft a malicious URL that exploits the open redirect vulnerability. The typical attack flow involves:

1. An attacker identifies the vulnerable endpoint in the React project creation flow
2. The attacker constructs a malicious URL pointing to the legitimate TeamCity server but containing a redirect parameter to an attacker-controlled site
3. The attacker distributes this URL through phishing emails, social engineering, or other channels
4. When a victim clicks the link, they are first directed to the trusted TeamCity server, then immediately redirected to the malicious destination
5. The attacker's site may host credential harvesting pages, malware, or other malicious content

This attack is particularly effective because the initial URL appears legitimate and may bypass email security filters that check only the primary domain.

Detection Methods for CVE-2026-28194

Indicators of Compromise

• Unusual redirect parameters in TeamCity access logs containing external domains
• HTTP requests to TeamCity project creation endpoints with suspicious URL parameters
• User reports of unexpected redirects when accessing TeamCity links
• Network traffic showing redirects from TeamCity servers to unknown external domains

Detection Strategies

• Monitor web application firewall (WAF) logs for requests containing redirect parameters pointing to external domains
• Implement URL parameter analysis on TeamCity endpoints to detect potential open redirect attempts
• Review access logs for unusual patterns in the project creation workflow
• Deploy network monitoring to detect unexpected outbound redirects from TeamCity infrastructure

Monitoring Recommendations

• Enable verbose logging on TeamCity servers to capture full request URLs including parameters
• Configure SIEM rules to alert on redirect patterns to untrusted domains originating from TeamCity
• Implement user behavior analytics to detect anomalous access patterns to project creation endpoints
• Establish baseline traffic patterns for TeamCity and alert on deviations

How to Mitigate CVE-2026-28194

Immediate Actions Required

• Upgrade JetBrains TeamCity to version 2025.11.3 or later immediately
• Review access logs for any evidence of exploitation attempts
• Alert users about potential phishing attacks leveraging TeamCity URLs
• Implement network-level controls to restrict outbound redirects if possible

Patch Information

JetBrains has addressed this vulnerability in TeamCity version 2025.11.3. Organizations should upgrade to this version or later to remediate CVE-2026-28194. The patch implements proper validation of redirect URLs to ensure they point only to trusted destinations within the application's domain.

For detailed information about security fixes, refer to the JetBrains Security Issues Fixed advisory page.

Workarounds

• Deploy a web application firewall (WAF) with rules to block requests containing external URLs in redirect parameters
• Implement network egress filtering to restrict redirects from TeamCity to only approved domains
• Educate users to verify URLs carefully before clicking links, even if they appear to originate from trusted internal systems
• Consider restricting access to the project creation flow to authenticated users only via network segmentation
• Use browser extensions or security tools that warn users about redirect chains