JetBrains YouTrack versions earlier than 2026.2.19197 allow an attacker who can modify an integration URL to expose the stored credentials for that integration. The vulnerability leads to unauthorized disclosure of confidential authentication details, enabling attackers to gain access to the external service that the integration connects to and potentially compromise data transmitted through that integration. The weakness is a Sensitive Data Exposure due to Configuration Changes and is classified as CWE‑918.

The affected product is JetBrains YouTrack. Any installation of YouTrack running a version prior to 2026.2.19197 is vulnerable. Versions 2026.2.19197 and later contain the patch that prevents credential exposure. There are no additional vendor or product variants listed that are affected.

The CVSS score of 6.5 indicates moderate severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. The attack requires the ability to alter an integration URL, which is typically restricted to administrators or users with permissions to manage integrations. Based on the description, the likely attack vector is an authenticated privileged user modifying the URL. Exploitation would expose the stored credentials, and while no public exploits have been reported, the potential impact on confidentiality is significant. The overall risk is moderate, increasing with the presence of privileged access to integration management functions.