JetBrains Hub released versions preceding 2026.2.52519 were found to allow the two‑factor authentication setting to be turned off through the profile update API endpoint. This missing authorization check permits any actor with API access to a Hub instance to disable MFA for a target account, effectively erasing an important layer of defense. Once MFA is disabled, attackers can gain unauthenticated or single‑factor authentication access to the affected user’s account, potentially compromising all data and resources that user can reach. The weakness is a classic Missing Authorization flaw (CWE‑863).

JetBrains Hub installations with versions older than 2026.2.52519 are affected; any instance that has not applied the hot‑fix benefits from the vulnerability.

With a CVSS v3 score of 8.1, the flaw is considered high‑severity. The EPSS score is not available and the vulnerability is not listed in CISA KEV, suggesting no widespread exploitation yet. Attackers can exploit the flaw remotely by sending a crafted profile update request to the Hub API, typically using an account whose profile can be altered. By removing the MFA flag, the attacker can then log in with just the user’s credentials, leading to potential unauthorized disclosure and modification of the user’s data.