In JetBrains YouTrack before version 2026.2.19197, a flaw allows an attacker to replay a notification signature and assume another user’s account. This bypasses authentication controls and permits the attacker to perform any actions the target account can, jeopardizing confidentiality, integrity, and availability of data. The underlying weakness is an insecure validation of signed data (CWE-863).

Affected systems are installations of JetBrains YouTrack that run a version older than 2026.2.19197. Any JetBrains YouTrack deployment without the 2026.2.19197 update may be vulnerable; specific sub‑version numbers prior to that milestone are impacted.

The CVSS score of 8.9 classifies this as a high severity vulnerability. Because the CVE does not list an EPSS score, exploitation probability is unknown, but the absence from KEV indicates no known public exploits yet. The likely attack vector is remote, requiring the attacker to intercept or forge a notification signature. Once replayed, the attacker can take over the target account with no additional privileges needed.