CVE-2026-123297Medium· 6.8▾ SunlitIn JetBrains Hub before 2026.2.52519 two-factor authentication bypass was possible via the password reset flow
▾ Sunlit zone — Low / medium · no exploitation signal
impact 37.4 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
In JetBrains Hub before 2026.2.52519 two-factor authentication bypass was possible via the password reset flow
Hub < 2026.2.52519Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-123294Critical· 9.6In JetBrains Hub before 2026.2.52556 privilege escalation was possible by changing email authentication details during the verification flow
CVE-2026-123295High· 8.1In JetBrains Hub before 2026.2.52519 enforced two-factor authentication could be disabled via the profile update endpoint
CVE-2026-123296High· 7.5In JetBrains Hub before 2026.2.52519 privilege escalation via forged email verification was possible
CVE-2026-123298Medium· 5.0In JetBrains Hub before 2026.2.52556 sMTP command injection via email verification was possible
CVE-2026-123300Low· 2.7In JetBrains Hub before 2026.2.52519 missing authorisation allowed users with read-only access to modify auth module group mappings
CVE-2026-123299Low· 3.1In JetBrains Hub before 2026.2.52519 information disclosure via user search queries was possible