Jetbrains Hub — known CVE vulnerabilities

Every CVE whose affected-product data names Jetbrains Hub, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.

CVEs (36)

• CVE-2026-50242 — CVSS 10.0 (critical): In JetBrains Hub before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 authentication bypass via…
• CVE-2026-56142 — CVSS 9.9 (critical): In JetBrains Hub before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 privilege escalation by…
• CVE-2021-36209 — CVSS 9.8 (critical): In JetBrains Hub before 2021.1.13389, account takeover was possible during password reset.
• CVE-2026-56141 — CVSS 9.8 (critical): In JetBrains Hub before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 account takeover via…
• CVE-2022-25262 — CVSS 9.8 (critical): In JetBrains Hub before 2022.1.14434, SAML request takeover was possible.
• CVE-2021-43183 — CVSS 9.8 (critical): In JetBrains Hub before 2021.1.13690, the authentication throttling mechanism could be bypassed.
• CVE-2022-25260 — CVSS 9.1 (critical): JetBrains Hub before 2021.1.14276 was vulnerable to blind Server-Side Request Forgery (SSRF).
• CVE-2026-25848 — CVSS 9.1 (critical): In JetBrains Hub before 2025.3.119807 authentication bypass allowing administrative actions was possible
• CVE-2021-43180 — CVSS 7.5 (high): In JetBrains Hub before 2021.1.13690, information disclosure via avatar metadata is possible.
• CVE-2021-31901 — CVSS 7.5 (high): In JetBrains Hub before 2021.1.13079, two-factor authentication wasn't enabled properly for the All Users group.
• CVE-2021-43182 — CVSS 7.5 (high): In JetBrains Hub before 2021.1.13415, a DoS via user information is possible.
• CVE-2020-11691 — CVSS 7.5 (high): In JetBrains Hub before 2020.1.12099, content spoofing in the Hub OAuth error message was possible.
• CVE-2022-24327 — CVSS 7.5 (high): In JetBrains Hub before 2021.1.13890, integration with JetBrains Account exposed an API key with excessive permissions.
• CVE-2019-12847 — CVSS 7.2 (high): In JetBrains Hub versions earlier than 2018.4.11298, the audit events for SMTPSettings show a cleartext password to the admin user. It is…
• CVE-2026-32229 — CVSS 6.8 (medium): In JetBrains Hub before 2026.1 possible on sign-in account mismatch with non-SSO auth and 2FA disabled
• CVE-2025-24456 — CVSS 6.7 (medium): In JetBrains Hub before 2024.3.55417 privilege escalation was possible via LDAP authentication mapping
• CVE-2022-24328 — CVSS 6.5 (medium): In JetBrains Hub before 2021.1.13956, an unprivileged user could perform DoS.
• CVE-2021-25759 — CVSS 6.5 (medium): In JetBrains Hub before 2020.1.12629, an authenticated user can delete 2FA settings of any other user.
• CVE-2021-37540 — CVSS 6.5 (medium): In JetBrains Hub before 2021.1.13262, a potentially insufficient CSP for the Widget deployment feature was used.
• CVE-2021-25757 — CVSS 6.1 (medium): In JetBrains Hub before 2020.1.12629, an open redirect was possible.
• CVE-2022-29811 — CVSS 6.1 (medium): In JetBrains Hub before 2022.1.14638 stored XSS via project icon was possible.
• CVE-2021-43181 — CVSS 6.1 (medium): In JetBrains Hub before 2021.1.13690, stored XSS is possible.
• CVE-2022-25259 — CVSS 6.1 (medium): JetBrains Hub before 2021.1.14276 was vulnerable to reflected XSS.
• CVE-2021-37541 — CVSS 6.1 (medium): In JetBrains Hub before 2021.1.13402, HTML injection in the password reset email was possible.
• CVE-2021-25760 — CVSS 5.3 (medium): In JetBrains Hub before 2020.1.12669, information disclosure via the public API was possible.
• CVE-2025-64683 — CVSS 5.3 (medium): In JetBrains Hub before 2025.3.104432 information disclosure was possible via the Users API
• CVE-2019-14955 — CVSS 5.3 (medium): In JetBrains Hub versions earlier than 2018.4.11436, there was no option to force a user to change the password and no password expiration…
• CVE-2019-18360 — CVSS 5.3 (medium): In JetBrains Hub versions earlier than 2019.1.11738, username enumeration was possible through password recovery.
• CVE-2022-48429 — CVSS 4.6 (medium): In JetBrains Hub before 2022.3.15573, 2022.2.15572, 2022.1.15583 reflected XSS in dashboards was possible
• CVE-2024-50573 — CVSS 4.3 (medium): In JetBrains Hub before 2024.3.47707 improper access control allowed users to generate permanent tokens for unauthorized services
• CVE-2022-48477 — CVSS 4.1 (medium): In JetBrains Hub before 2023.1.15725 SSRF protection in Auth Module integration was missing
• CVE-2022-34894 — CVSS 3.5 (low): In JetBrains Hub before 2022.2.14799, insufficient access control allowed the hijacking of untrusted services
• CVE-2022-45471 — CVSS 3.5 (low): In JetBrains Hub before 2022.3.15181 Throttling was missed when sending emails to a particular email address
• CVE-2024-38507 — CVSS 3.5 (low): In JetBrains Hub before 2024.2.34646 stored XSS via project description was possible
• CVE-2025-64682 — CVSS 2.7 (low): In JetBrains Hub before 2025.3.104432 a race condition allowed bypass of the Agent-user limit
• CVE-2025-64681 — CVSS 2.7 (low): In JetBrains Hub before 2025.3.104992 a race condition allowed bypass of the user limit via invitations