An attacker can reset an account password without satisfying the required two‑factor challenge by exploiting a flaw in the password reset flow. This bypass allows the attacker to control the account’s credentials, potentially accessing all data the user can access and compromising the confidentiality and integrity of the system.

JetBrains Hub installations prior to version 2026.2.52519 are affected; newer releases have fixed the issue.

The CVSS score of 6.8 indicates a moderate level of risk. No EPSS data is available, and the vulnerability is not currently listed in the CISA KEV catalog. The attack likely originates from a remote web interface where an unauthenticated user initiates a password reset and can complete it without completing the two‑factor step. Security teams should consider the vulnerability a moderate threat until a patch is applied.