CVE-2025-64682: 
NixOS vulnerability analysis and mitigation

In JetBrains Hub before version 2025.3.104432, a race condition vulnerability was discovered that allowed attackers to bypass the Agent-user limit. This vulnerability was assigned CVE-2025-64682 and was disclosed on November 10, 2025 (NVD).

The vulnerability is classified with CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization). According to the CVSS 3.1 scoring, it received a base score of 3.7 (LOW) with the vector string CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N, indicating network accessibility, high attack complexity, no privileges required, no user interaction needed, unchanged scope, no impact on confidentiality, low impact on integrity, and no impact on availability (NVD).

The primary impact of this vulnerability is on the integrity of the system, specifically allowing unauthorized bypass of the Agent-user limit. The vulnerability has a low severity impact, with no effects on confidentiality or availability of the system (NVD).

The vulnerability has been fixed in JetBrains Hub version 2025.3.104432. Users are advised to upgrade to this version or later to mitigate the vulnerability (JetBrains Advisory).