In JetBrains YouTrack versions prior to 2025.3.119033, the system writes access tokens to mailbox logs without sanitization, allowing potential extraction of tokens. An attacker who can read these logs could obtain credentials that provide full access to the YouTrack instance, compromising confidentiality and potentially enabling further actions such as data exfiltration or unauthorized modifications. The weakness aligns with CWE-532, which describes insecure log handling.

Affected vendors and products include JetBrains YouTrack. Any installation of YouTrack earlier than version 2025.3.119033 is vulnerable. The specific version boundary is provided by the description: before 2025.3.119033. No other product or vendor listings are noted.

The CVSS base score of 6.5 reflects a moderate severity with potential impact on confidentiality. EPSS indicates a low likelihood of exploitation (<1%). The vulnerability is not yet listed in CISA's KEV catalog, suggesting it is not a widely exploited or known, targeted threat. Likely attack vectors involve reading mailbox logs, which may be accessible to authenticated users or system administrators, so the risk is higher for organizations with broad log access permissions.