JetBrains YouTrack stores SMTP server credentials in its configuration. By changing the configured server host, an attacker can trigger the application to display or leak these stored credentials. This weakness falls under CWE-522, leading to unauthorised access to the SMTP account, enabling phishing, spamming or data exfiltration through email.

The vulnerability affects JetBrains YouTrack versions prior to 2026.2.18991. Any YouTrack deployment using an older release is susceptible unless the SMTP host configuration is protected.

The CVSS score of 2.7 indicates a low to moderate severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog, so exploitation likelihood is considered low. Based on the description, the likely attack vector requires an attacker to modify the SMTP host setting, which typically requires administrative privileges or local access to the YouTrack instance. No public exploits have been reported.