JetBrains Hub allows a user to be authenticated as an unintended account when signing in with a non‑SSO authentication method while two‑factor authentication is disabled. This flaw, identified as a credential bypass, permits an attacker to access data or perform actions on behalf of another user. The vulnerability stems from improper enforcement of account matching conditions during the sign‑in workflow and is catalogued as CWE‑290.

The flaw affects JetBrains Hub versions older than 2026.1. Any deployment of Hub before that release is susceptible, regardless of the specific minor revision. It applies to all installations that rely on non‑SSO authentication with 2FA disabled.

The CVSS base score of 6.8 places the vulnerability in a moderate risk range, while an EPSS score of less than 1% indicates a low likelihood of widespread exploitation at present. The vulnerability is not present in the CISA KEV catalog. Exploitability requires the attacker to initiate a sign‑in sequence with a non‑SSO method on an account that has 2FA turned off, making it a remote, credential‑based attack. The compromised accounts can then read or modify user data, potentially leading to business impact if sensitive information is accessed.