{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3ajetbrainsyoutrack/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":["LHeiakim"],"_cs_cpes":["cpe:2.3:a:jetbrains:youtrack:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.8,"id":"CVE-2026-86478"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["YouTrack (\u003c 2025.3.161254, \u003c 2026.1.14042)"],"_cs_severities":["critical"],"_cs_tags":["jetbrains","authentication-bypass","cve","account-takeover"],"_cs_type":"threat","_cs_vendors":["JetBrains"],"content_html":"\u003cp\u003eJetBrains YouTrack Helpdesk contains a critical authentication bypass vulnerability (CVE-2026-86478) originating from improper validation in the reporter account merging logic. The flaw allows an unauthenticated user to associate their reporter account with the email address of a legitimate target. Because the application fails to verify the reporter type or account ownership during the merge process, the attacker can force the system to merge their account into the target account, resulting in the generation of an interactive login URL that grants full access to the victim's session.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker submits a public Helpdesk form using their own email address to trigger account creation as an unverified REPORTER.\u003c/li\u003e\n\u003cli\u003eThe attacker receives a confirmation email containing a magic-link signed token (valid for 14 days).\u003c/li\u003e\n\u003cli\u003eThe attacker opens the magic-link to establish a browser session as the reporter.\u003c/li\u003e\n\u003cli\u003eThe attacker navigates to their profile and modifies the associated email address to match that of the target user (e.g., an administrator).\u003c/li\u003e\n\u003cli\u003eThe attacker opens the original magic-link again.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003eonReporterEmailVerified\u003c/code\u003e function processes the session, detects the shared email, and executes an insecure merge into the target account.\u003c/li\u003e\n\u003cli\u003eThe system generates and returns a Hub interactive login URL associated with the merged (victim) account.\u003c/li\u003e\n\u003cli\u003eThe attacker navigates to the returned login URL to obtain an active, authenticated session as the victim.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability allows full unauthorized access to any user account within the affected YouTrack instance, including accounts with administrative privileges, leading to complete instance compromise.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePatch YouTrack immediately: Upgrade to version 2025.3.161254 or 2026.1.14042 or later.\u003c/li\u003e\n\u003cli\u003eMitigate until patched: Disable the Helpdesk feature or restrict account self-service profile updates.\u003c/li\u003e\n\u003cli\u003eReview Audit Logs: Monitor for unexpected \u0026quot;Merging reporters with email\u0026quot; events and excessive use of \u003ccode\u003ePOST /api/reporterLanding\u003c/code\u003e endpoints from unknown or unverified reporter sessions.\u003c/li\u003e\n\u003cli\u003eProactive Hardening: Rotate tokens and credentials for administrative accounts if a compromise is suspected.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-22T00:38:15Z","date_published":"2026-10-22T00:38:15Z","id":"https://feed.craftedsignal.io/briefs/2026-10-jetbrains-youtrack-auth-bypass/","summary":"An authentication bypass vulnerability in JetBrains YouTrack Helpdesk allows unauthenticated attackers to hijack any user account, including administrators, by spoofing emails to trigger an insecure account merging process.","title":"JetBrains YouTrack: Helpdesk authentication bypass via account merging (CVE-2026-86478)","url":"https://feed.craftedsignal.io/briefs/2026-10-jetbrains-youtrack-auth-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:jetbrains:youtrack:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}