Attack Chain

1. An attacker submits a public Helpdesk form using their own email address to trigger account creation as an unverified REPORTER.
2. The attacker receives a confirmation email containing a magic-link signed token (valid for 14 days).
3. The attacker opens the magic-link to establish a browser session as the reporter.
4. The attacker navigates to their profile and modifies the associated email address to match that of the target user (e.g., an administrator).
5. The attacker opens the original magic-link again.
6. The onReporterEmailVerified function processes the session, detects the shared email, and executes an insecure merge into the target account.
7. The system generates and returns a Hub interactive login URL associated with the merged (victim) account.
8. The attacker navigates to the returned login URL to obtain an active, authenticated session as the victim.

Impact

The vulnerability allows full unauthorized access to any user account within the affected YouTrack instance, including accounts with administrative privileges, leading to complete instance compromise.

Recommendation

• Patch YouTrack immediately: Upgrade to version 2025.3.161254 or 2026.1.14042 or later.
• Mitigate until patched: Disable the Helpdesk feature or restrict account self-service profile updates.
• Review Audit Logs: Monitor for unexpected "Merging reporters with email" events and excessive use of POST /api/reporterLanding endpoints from unknown or unverified reporter sessions.
• Proactive Hardening: Rotate tokens and credentials for administrative accounts if a compromise is suspected.