CVE-2025-68166: 
JetBrains TeamCity vulnerability analysis and mitigation

CVE-2025-68166 is a DOM-based Cross-Site Scripting (XSS) vulnerability in JetBrains TeamCity affecting the OAuth connections tab. It impacts all TeamCity versions prior to 2025.11 and was published on December 16, 2025. The vulnerability carries a CVSS v3.1 base score of 6.1 (Medium) (Red Hat Advisory, JetBrains Advisory).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting), specifically of the DOM-based variant (CAPEC-588). The flaw exists in the OAuth connections tab of the TeamCity web interface, where attacker-controlled input is processed by client-side JavaScript and written to the DOM without adequate sanitization or encoding. Exploitation requires no authentication but does require user interaction — a victim must visit or be directed to a maliciously crafted page or URL that triggers the DOM manipulation (Red Hat Advisory, JetBrains Advisory).

Successful exploitation allows an attacker to inject and execute arbitrary JavaScript in the context of a victim's browser session on the TeamCity instance. This can lead to theft of session tokens and credentials — particularly dangerous if the victim is a TeamCity administrator — as well as unauthorized actions performed on behalf of the victim, such as modifying CI/CD pipeline configurations. Confidentiality and integrity are both impacted at a low level, while availability is not directly affected (Red Hat Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of publication. The EPSS score is approximately 0.158%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Detection plugins are available via Nessus (plugin 279408) and Qualys (detection ID 530766) (Tenable Nessus, Red Hat Advisory).

1. Reconnaissance: Identify publicly accessible JetBrains TeamCity instances running versions prior to 2025.11, using tools like Shodan or Censys, or by targeting known internal deployments.
2. Craft malicious payload: Construct a URL or page that, when visited by a TeamCity user on the OAuth connections tab, injects a malicious JavaScript payload into the DOM via an unsanitized input parameter processed client-side.
3. Deliver the payload: Trick a TeamCity user (ideally an administrator) into visiting the crafted URL via phishing, social engineering, or embedding the link in a shared resource.
4. Execute malicious script: Once the victim loads the page, the injected script executes in their browser context, enabling the attacker to steal session cookies, capture credentials, or perform actions on the TeamCity instance on behalf of the victim (Red Hat Advisory, JetBrains Advisory).

• Network: Unusual outbound requests from a user's browser to external domains shortly after visiting the TeamCity OAuth connections tab; unexpected HTTP requests to attacker-controlled infrastructure originating from TeamCity user sessions.
• Logs: TeamCity access logs showing requests to the OAuth connections tab with anomalous or encoded query parameters; browser console errors related to unexpected script execution on the OAuth tab.
• Process/Session: Unexpected administrative actions (e.g., new OAuth connections added, pipeline modifications) performed under a legitimate user's session without their knowledge.

JetBrains has released a fix in TeamCity version 2025.11; upgrading to this version or later is the primary recommended remediation (JetBrains Advisory). As interim mitigations, administrators should restrict access to the TeamCity OAuth connections tab to trusted users only, deploy a Web Application Firewall (WAF) configured to detect and block XSS payloads, and monitor for suspicious activity or unexpected script executions. Users should also ensure browser security controls (e.g., Content Security Policy headers) are enforced where possible.