CVE-2026-100277 is an account takeover flaw in JetBrains YouTrack, where a notification signature could be replayed. NVD scores it 8.9, high severity. The record says versions before 2026.2.19197 are affected, so upgrade self hosted installs to 2026.2.19197 or later and review recent account activity.
What's affected
The CVE record says: "In JetBrains YouTrack before 2026.2.19197 account takeover was possible by replaying a notification signature."
- Product: JetBrains YouTrack.
- Affected: versions before 2026.2.19197.
- Fixed: 2026.2.19197, going by the record.
- Severity: CVSS 8.9, vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L. No login or user action is needed, complexity is high, and the scope is changed. - Exploitation: neither the record nor any source I could read reports exploitation. It is not on the CISA KEV list.
- Related: the same JetBrains release range also covers CVE-2026-100273, an authorisation bypass in the scripts debugger. They are separate flaws, and one upgrade addresses both.
JetBrains publishes the details on its Fixed security issues page. When I tried to read that page it loaded as a script-driven shell with no advisory text, so this post relies on the CVE record for versions and descriptions. Confirm against the page before you act on a version number.
How to check if you're exposed
Check your YouTrack version in the product's administration area, or from the image tag or package version. Anything below 2026.2.19197 is in scope for self hosted installs. For the hosted service, look for guidance from JetBrains.
Then look for signs of misuse. The flaw involves notification signatures, so the sensible places to look are the logs and settings around email and notification links. Check for password changes, new sessions from unfamiliar addresses and administrator actions that nobody on your team recalls, in the weeks before you patched.
Finally, think about reach. The vector lists no privileges required, so any person who can send requests to your server is in the pool, and the internet is the largest pool of all.
What to do now
- Upgrade self hosted YouTrack to 2026.2.19197 or later, following JetBrains instructions for your install.
- After upgrading, review account activity: recent password changes, new sessions and permission changes, especially on administrator accounts.
- Force a password reset and sign out active sessions for any account where you see activity you cannot explain.
- Restrict network access to the server to your staff networks or a VPN where that fits how you work.
- Rotate any tokens and integration credentials that live in YouTrack if you suspect a takeover happened.
Why it matters
The weakness is CWE-863, incorrect authorization. The record describes the mechanism in a few words: a notification signature could be replayed. A signature on a notification link is meant to prove that the link came from the server and is meant for one action. If the same signature can be used again, or in a different place, the proof stops proving anything.
Replay problems come from checks that confirm a message is genuine but not that it is fresh or scoped. The usual fixes are a short lifetime, a single use token and binding the signature to the exact action and account. I do not know which of these JetBrains applied, and the record does not say.
An account takeover is worse than a data leak in one respect: the attacker acts as a real person, so logs look normal. The CVSS vector reaches a high rating for confidentiality and integrity, and a changed scope. Treat the upgrade as urgent for any YouTrack that holds private projects.
Quick check
What does replaying a notification signature mean?
The record says a signature on a notification could be reused to take over an account. A well designed signature should work once, for one action, for a short time.
Is this the same flaw as CVE-2026-100273?
No. That one is an authorisation bypass in the scripts debugger. Both are fixed in versions from 2026.2.19197, so one upgrade covers both.
Sources
Last reviewed: 19 October 2026.
