CVE-2025-64688: 
YouTrack vulnerability analysis and mitigation

In JetBrains YouTrack before version 2025.3.104432, a security vulnerability was identified involving missing VCS URL validation that allowed delegation to unauthorized repositories from the Junie widget. The vulnerability was discovered and disclosed on November 10, 2025, and was assigned identifier CVE-2025-64688. This issue affects JetBrains YouTrack installations prior to version 2025.3.104432 (NVD Database).

The vulnerability has been assigned a CVSS v3.1 base score of 7.3 (HIGH) by NIST with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. JetBrains s.r.o. initially rated it with a slightly higher CVSS score of 7.4 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L. The vulnerability is classified under CWE-639 (Authorization Bypass Through User-Controlled Key) (NVD Database).

The vulnerability affects the confidentiality, integrity, and availability of the system, each with a low impact rating. The security issue allows potential attackers to perform unauthorized repository delegation through the Junie widget, which could compromise system security (NVD Database).

The vulnerability has been addressed in JetBrains YouTrack version 2025.3.104432. Users are advised to upgrade to this version or later to mitigate the security risk (JetBrains Advisory).