JetBrains IntelliJ IDEA allows a user to open arbitrary URLs automatically when a remote development session uses port forwarding, without presenting the user with a confirmation prompt. This behaviour can be exploited to drive users to malicious web content or phishing sites, potentially compromising credentials or facilitating malware delivery. The weakness is identified as CWE-357.

All JetBrains IntelliJ IDEA installations before version 2026.3 are affected. The vulnerability exists when using Remote Development with the port forwarding feature. No specific build number is stated, but any release prior to 2026.3 carries the risk.

The likely attack vector is a remote development session that uses the port forwarding feature, allowing an attacker to trigger arbitrary URL redirection. The CVSS scoring indicates a moderate severity of 4.7. There is no EPSS score available, so the perceived likelihood of exploitation in the wild is indeterminate, and the vulnerability is not listed in CISA’s KEV catalog. The attack requires a remote development session that redirects the client to an arbitrary URL, which an attacker can trigger from a compromised or malicious development environment. Because the client accepts URLs blindly, this flaw can lead to phishing, credential theft, or drive‑by malware incidents. The exploit is relatively easy once port forwarding is enabled, but it still requires the victim to initiate a remote session, which reduces the attack surface compared to remote code execution flaws.