CVE-2026-25848 is an authentication bypass in JetBrains Hub before version 2025.3.119807, scored 9.1. The vendor says it allowed administrative actions without proper authentication. Update Hub to 2025.3.119807 or later, and read JetBrains' fixed issues page for details. Read the vendor's fixed issues page for the entry covering this issue.
What's affected
- Product: JetBrains Hub, the user and access management service used with other JetBrains server products.
- Affected: versions before 2025.3.119807.
- Fixed: 2025.3.119807.
- Detail: the record gives only a one line description, so read the vendor page for scope.
How to check if you're exposed
Open the Hub administration area and read the version shown, or check your container image tag:
docker ps --format '{{.Image}}' | grep -i hub
Compare with 2025.3.119807. If you run Hub as part of YouTrack or TeamCity, check how your edition packages it.
What to do now
- Upgrade Hub to 2025.3.119807 or later.
- Review the Hub audit log for administrative changes you did not make: new admin users, changed permissions and new service accounts.
- Rotate service account tokens and OAuth secrets if you find anything unexpected.
- Limit network access to Hub to the networks that need it.
- Read the JetBrains security fixes page for the entry on this issue.
Why it matters
The record classifies this as CWE-306, missing authentication for a critical function. A function that changes administrative state could be reached without proving who was calling.
Hub is an identity service, which makes it a high value target: control of it often means control of the tools that trust it. The public description is short, so I will not guess at mechanics. The record does not mark this CVE as exploited in the wild.
Quick check
Why is an auth bypass in an identity hub serious?
Other tools trust Hub to say who is allowed to do what. If Hub can be bypassed, that trust is misplaced across the connected systems.
Sources
Last reviewed: 19 October 2026.
