CVE-2026-32229: 
NixOS vulnerability analysis and mitigation

CVE-2026-32229 is an authentication bypass vulnerability in JetBrains Hub that allows a sign-in account mismatch when non-SSO authentication is used and two-factor authentication (2FA) is disabled. It affects JetBrains Hub versions before 2025.3.128064 (also referenced as before 2026.1). The vulnerability was published on March 11, 2026, with a patch released by JetBrains. It carries a CVSS v3.1 base score of 6.8 (High) (JetBrains Advisory, ENISA EUVD).

The vulnerability is classified as CWE-290 (Authentication Bypass by Spoofing), occurring during the sign-in flow of JetBrains Hub when non-SSO authentication is active and 2FA is not enforced. Under these conditions, a flaw in account identity resolution during authentication allows a low-privileged, authenticated user to trigger a mismatch that results in access to a different user's account. The attack requires network access and high complexity to execute, with no user interaction needed beyond the attacker's own authentication (JetBrains Advisory, ENISA EUVD).

Successful exploitation allows a low-privileged attacker to gain unauthorized access to other user accounts within JetBrains Hub, resulting in high confidentiality and integrity impact — including potential exposure of sensitive project data, tokens, and account settings. Availability is not affected. Given Hub's role as a centralized authentication and team management platform for JetBrains tools (YouTrack, TeamCity, etc.), account compromise could facilitate lateral movement into connected development infrastructure (ENISA EUVD, JetBrains Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of reporting. The EPSS score is extremely low at 0.00001, reflecting minimal current exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires the attacker to already hold valid (low-privileged) credentials and the target environment to have SSO disabled and 2FA not enforced, which limits the attack surface (ENISA EUVD).

1. Reconnaissance: Identify JetBrains Hub instances running versions prior to 2025.3.128064 that are configured with non-SSO (local/LDAP) authentication and have 2FA disabled for user accounts.
2. Obtain low-privileged credentials: Acquire valid credentials for any low-privileged account on the target Hub instance (e.g., through phishing, credential stuffing, or insider access).
3. Initiate sign-in with account mismatch: Leverage the authentication flow flaw — likely by manipulating sign-in request parameters or session state — to trigger an account identity mismatch during the authentication process.
4. Gain access to target account: Due to the mismatch, the Hub server resolves the session to a different (potentially higher-privileged) user account, granting the attacker access to that account's data, tokens, and settings (JetBrains Advisory, ENISA EUVD).

• Logs: Hub authentication logs showing successful logins from a user account immediately followed by access to resources or settings belonging to a different user account; unexpected session creation events tied to mismatched user identifiers.
• Network: Repeated or anomalous sign-in requests to the Hub login endpoint from the same source IP targeting multiple accounts in quick succession.
• Behavioral: User accounts reporting unexpected activity (e.g., changed settings, revoked tokens) without corresponding legitimate login events; access to Hub-connected services (YouTrack, TeamCity) from accounts that did not initiate a session.

JetBrains has released a fix in Hub version 2025.3.128064 (2026.1 and later); administrators should upgrade immediately. As an interim workaround, enable SSO authentication and enforce two-factor authentication (2FA) for all users, as the vulnerability only affects environments using non-SSO auth with 2FA disabled. Administrators should also review Hub access logs for any signs of unauthorized account access prior to patching (JetBrains Advisory).