CVE-2026-86478: JetBrains YouTrack Auth Bypass Vulnerability

CVE-2026-86478 Overview

CVE-2026-86478 is an improper authentication vulnerability [CWE-290] in JetBrains YouTrack Helpdesk. The flaw allows unauthenticated attackers to take over accounts by asserting an arbitrary email address. JetBrains fixed the issue in YouTrack versions 2025.3.161254 and 2026.1.14042.

The vulnerability affects the Helpdesk component and requires no privileges or user interaction. Attackers can exploit it remotely over the network to gain full control of victim accounts. Successful exploitation compromises confidentiality, integrity, and availability of the targeted YouTrack instance.

Critical Impact
Unauthenticated attackers can hijack YouTrack Helpdesk accounts by self-asserting a victim's email address, leading to full account takeover without user interaction.

Affected Products

JetBrains YouTrack versions prior to 2025.3.161254
JetBrains YouTrack versions prior to 2026.1.14042
YouTrack Helpdesk component

Discovery Timeline

2026-09-07 - CVE-2026-86478 published to the National Vulnerability Database (NVD)
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-86478

Vulnerability Analysis

The vulnerability resides in the authentication logic of the YouTrack Helpdesk module. The system trusts email addresses supplied by unauthenticated clients without verifying ownership. An attacker submits a target email address and the application binds the session to the corresponding account.

This pattern maps to CWE-290: Authentication Bypass by Spoofing. The Helpdesk workflow was designed to accept email-based identifiers from external reporters. However, the validation logic failed to distinguish between claimed identity and cryptographically verified identity. The result is that any email tied to an existing YouTrack account can be impersonated.

An EPSS score of 0.358% suggests limited public exploitation activity at disclosure time. Organizations exposing YouTrack Helpdesk to the internet face elevated risk because no authentication or interaction is required.

Root Cause

The root cause is missing verification of email address ownership during Helpdesk request handling. The application accepts a self-asserted email claim and treats it as authenticated identity. No token, one-time code, or session challenge validates that the requester controls the mailbox.

Attack Vector

The attack vector is network-based and unauthenticated. An adversary sends a crafted request to the Helpdesk endpoint containing the email address of a valid YouTrack user. The server issues a session or authorization context tied to that account. The attacker then interacts with YouTrack as the victim, including administrative users when their email is targeted.

No verified public exploit code is available for CVE-2026-86478. See the JetBrains Security Issues Fixed advisory for vendor-provided technical details.

Detection Methods for CVE-2026-86478

Indicators of Compromise

Unexpected authentication events in YouTrack audit logs where session origin does not match the user's usual IP range or geolocation.
Helpdesk ticket creation or modification activity attributed to accounts that did not initiate the sessions.
New API tokens, permission changes, or project role assignments granted by administrative accounts outside normal change windows.
Password reset or email change requests submitted through the Helpdesk interface from anonymous or Tor exit nodes.

Detection Strategies

Review YouTrack audit and access logs for authentication events lacking corresponding password, SSO, or multi-factor authentication (MFA) records.
Correlate Helpdesk request source IP addresses with subsequent authenticated user activity to identify sessions established without valid credentials.
Alert on privilege changes, project ownership transfers, or integration token creation performed by users outside expected working patterns.

Monitoring Recommendations

Forward YouTrack access, audit, and Helpdesk logs to a centralized SIEM for correlation with network and identity telemetry.
Monitor for anomalous account behavior after any Helpdesk interaction, including changes to notification email addresses.
Track outbound API calls from YouTrack service accounts for signs of data exfiltration following suspicious logins.

How to Mitigate CVE-2026-86478

Immediate Actions Required

Upgrade all YouTrack instances to version 2025.3.161254, 2026.1.14042, or later immediately.
Restrict Helpdesk endpoint exposure to trusted networks or place YouTrack behind an authenticating reverse proxy until patched.
Rotate API tokens, session cookies, and integration credentials issued by YouTrack after patching.
Audit user accounts, administrator role assignments, and recently created tickets for unauthorized changes.

Patch Information

JetBrains released fixed builds 2025.3.161254 and 2026.1.14042 that correct the improper authentication logic in YouTrack Helpdesk. Cloud-hosted YouTrack instances managed by JetBrains have been updated by the vendor. Self-hosted deployments require manual upgrade. Refer to the JetBrains Security Issues Fixed page for release notes.

Workarounds

Disable the YouTrack Helpdesk feature until upgrade is complete if the module is not required for operations.
Enforce network-level access controls limiting Helpdesk endpoints to authenticated VPN users or known IP ranges.
Require MFA on all YouTrack accounts to reduce the impact of session hijacking even if authentication logic is bypassed.

bash

# Example: restrict YouTrack Helpdesk endpoints at the reverse proxy
# nginx configuration snippet
location /api/helpdesk/ {
    allow 10.0.0.0/8;
    allow 192.168.0.0/16;
    deny all;
    proxy_pass http://youtrack_backend;
}