The flaw appears in the JetBrains Toolbox App login dialog before version 3.9. When the warning that a server is not recognized is missing, a user can inadvertently connect to a malicious server. This improper handling of credentials can lead to the credentials being sent to an attacker, exposing authentication information and allowing further malicious activity on the user’s behalf.

JetBrains Toolbox App deployments running any version earlier than 3.9 are affected. The vulnerability is present in all users’ installations that have not upgraded to the 3.9 release or later.

The vulnerability carries a CVSS score of 3.1, indicating low severity. No exploit probability score (EPSS) is available, and the flaw is not listed in the CISA KEV catalog. Based on the description, it appears that an attacker would need to lure or trick a user into accepting the connection to a malicious server. The attack requires user interaction and therefore is less likely to be automated, but credential leakage could still occur if the user logs in after connecting to the rogue host.