JetBrains YouTrack versions before 2026.2.18991 expose a flaw in the mailbox integration that permits authentication even after a password reset has been requested. This weakness allows an attacker who can trigger the mailbox integration flow to gain access without completing a fresh authentication cycle, effectively bypassing the intended security boundary introduced by the password reset mechanism. No arbitrary code execution or privilege escalation beyond the authenticated session is described, so the impact is limited to unauthorized persistence of access.

The affected system is JetBrains YouTrack, all releases prior to 2026.2.18991. Users running these older versions should check the JetBrains security advisory for the specific release containing the fix.

The CVSS score of 5.3 indicates a moderate risk, and the EPSS score is not available, meaning current exploitation probability data is lacking. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is through the mailbox integration feature, which may be triggered remotely if the integration is exposed to external entities or compromised email accounts. Attackers would need to have some level of access to the mailbox integration setup or be able to influence the reset process to exploit this flaw. Overall, the risk is moderate and constrained to authentication persistence rather than full system compromise.