JetBrains TeamCity prior to 2026.2, 2026.1.4, and 2025.11.8 contains a flaw (CWE-1289) that allows an attacker to reset the administrator password and thereby assume full administrative control. The vulnerability arises from insufficient validation during the password reset process, enabling an attacker to bypass authentication and gain privileged access. This weakness can be exploited remotely and grants the attacker complete control over the TeamCity instance, potentially compromising all projects and hosted code.

The affected product is JetBrains TeamCity. Vulnerable releases include 2025.11.8, 2026.1.4, and versions prior to 2026.2. No newer releases are affected.

The CVSS score of 8.1 indicates a high severity vulnerability. Although the EPSS score is not available, the lack of listing in the CISA KEV catalog suggests no known exploits in the wild yet. Based on the description, the likely attack vector is exploitation of the publicly accessible password reset feature to reset the administrator password. If unpatched, an attacker could takeover the administrator account, compromising confidentiality, integrity, and availability of the entire server.