CVE-2026-62422: JetBrains YouTrack Auth Bypass Vulnerability

CVE-2026-62422 Overview

CVE-2026-62422 is an authentication bypass vulnerability in JetBrains YouTrack, the vendor's project management and issue tracking platform. Attackers can obtain administrative access by leveraging direct database access, bypassing the application's authentication layer entirely. The flaw is classified under [CWE-306] Missing Authentication for Critical Function and carries a maximum CVSS 3.1 base score of 10.0 with scope change. JetBrains addressed the issue across multiple release branches, including 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, and 2024.2.148429.

Critical Impact
Unauthenticated network attackers can gain full administrative control of vulnerable YouTrack instances, exposing source code references, credentials, and project data across the connected environment.

Affected Products

JetBrains YouTrack versions prior to 2026.1.13757
JetBrains YouTrack 2025.x branches prior to 2025.3.148033, 2025.2.148048, and 2025.1.148120
JetBrains YouTrack 2024.x branches prior to 2024.3.148430 and 2024.2.148429

Discovery Timeline

2026-07-14 - CVE-2026-62422 published to NVD
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-62422

Vulnerability Analysis

CVE-2026-62422 stems from a missing authentication check on a code path that reaches privileged operations through direct database access. An unauthenticated attacker reachable over the network can bypass the standard login flow and act with administrative privileges. Because the vulnerability's scope is changed, exploitation impacts components beyond the vulnerable YouTrack instance itself, including integrated services and repositories that trust YouTrack identity claims. The Exploit Prediction Scoring System (EPSS) probability sits at 0.346% as of 2026-07-20, but the ease of exploitation and total impact justify immediate patching regardless of current exploitation telemetry.

Root Cause

The root cause is a missing authentication guard on an interface that interacts with YouTrack's underlying data store. Instead of enforcing session validation before performing sensitive lookups or updates, the affected code path exposes administrative operations to any caller. This aligns with [CWE-306] Missing Authentication for Critical Function, where security-sensitive functions accept requests without verifying identity.

Attack Vector

Exploitation requires only network access to the YouTrack service. Attackers do not need prior credentials, user interaction, or elevated privileges. Once administrative access is obtained, an attacker can create or modify user accounts, exfiltrate issue data, pivot to integrated systems such as source control, and plant persistence mechanisms. JetBrains has not published technical exploitation details. Refer to the JetBrains Security Issues Fixed advisory for vendor guidance.

Detection Methods for CVE-2026-62422

Indicators of Compromise

Unexpected creation of administrator accounts or elevation of existing accounts within YouTrack
Access log entries showing privileged API calls without a preceding authenticated session
Anomalous outbound connections from the YouTrack host to attacker-controlled infrastructure
Modifications to integration tokens, webhooks, or OAuth clients that were not initiated by administrators

Detection Strategies

Review YouTrack audit logs for administrative actions correlated with unauthenticated or anonymous session identifiers
Compare current administrator group membership against a known-good baseline captured before the patch date
Alert on direct connections to the YouTrack database from processes or hosts outside the approved application tier

Monitoring Recommendations

Ingest YouTrack application, access, and database logs into a centralized SIEM for correlation
Monitor authentication events for gaps where administrative operations occur without matching login records
Track configuration changes to authentication providers, SSO settings, and API token issuance

How to Mitigate CVE-2026-62422

Immediate Actions Required

Upgrade YouTrack to a fixed release: 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, or 2024.2.148429
Restrict network access to the YouTrack service and its database to trusted management networks until patching completes
Rotate administrator credentials, API tokens, and integration secrets stored within YouTrack
Audit administrator accounts and recent privilege changes for unauthorized activity

Patch Information

JetBrains has released fixed builds across all supported YouTrack branches. Consult the JetBrains Security Issues Fixed page for the authoritative list of remediated versions and upgrade instructions. Self-hosted deployments must apply the update manually, while JetBrains Cloud instances have been patched by the vendor.

Workarounds

Block inbound network access to the YouTrack instance and its database from untrusted networks
Place YouTrack behind an authenticating reverse proxy or VPN that enforces identity before requests reach the application
Disable or firewall off direct database ports so only the YouTrack application host can reach the datastore

bash

# Configuration example: restrict database access to the YouTrack application host only
# Adjust interface, source address, and database port to match your deployment
iptables -A INPUT -p tcp --dport 5432 -s <youtrack_app_host_ip> -j ACCEPT
iptables -A INPUT -p tcp --dport 5432 -j DROP