A flaw in JetBrains TeamCity versions before 2025.11.3 allows a disabling of versioned settings to leave a credentials configuration file permanently on disk, exposing authentication data. This is classified as an improper handling of security data weakness.

All installations of JetBrains TeamCity running a version earlier than 2025.11.3 are affected, regardless of edition.

The CVSS score is 2.3, indicating low severity. The EPSS score of less than 1% suggests a very small chance of exploitation. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker would need local file system access to read the residual credentials file, or a prior compromise that allows read of the configuration directory. Because the credentials are stored on disk, compromise of the file can lead to unauthorized access to TeamCity services and potentially other systems where those credentials are reused.