CVE-2025-54529: 
JetBrains TeamCity vulnerability analysis and mitigation

A Cross-Site Request Forgery (CSRF) vulnerability was discovered in JetBrains TeamCity versions before 2025.07, affecting the external OAuth login integration functionality. The vulnerability was assigned CVE-2025-54529 and was disclosed on July 28, 2025 (NVD).

The vulnerability has been assigned a CVSS v3.1 base score of 7.5 (HIGH) with the vector string CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. The vulnerability is classified as CWE-352 (Cross-Site Request Forgery). The attack vector is network-based, requires high attack complexity, needs no privileges, but does require user interaction (NVD).

If successfully exploited, this CSRF vulnerability could potentially allow attackers to perform unauthorized actions in the context of authenticated users when they interact with malicious content. The high CVSS score indicates potential severe impacts on confidentiality, integrity, and availability of the system (NVD).

The vulnerability has been fixed in TeamCity version 2025.07. Users are advised to upgrade to this version or later to mitigate the risk. No alternative workarounds have been publicly disclosed (JetBrains Advisory).