This vulnerability arises from JetBrains TeamCity's parameter autocompletion feature exposing credentials parameters, which can be read by anyone who can access the autocomplete UI. The flaw is a missing authorization issue (CWE‑862) that allows an attacker to view sensitive session data or passwords that should remain confidential. Consequences include potential credential theft, privilege escalation, or unauthorized access to protected resources.

All JetBrains TeamCity releases prior to version 2026.1 are affected. Users running any earlier build should assume that credentials may be exposed through the web interface until a fixing release is applied.

The CVSS score of 4.3 indicates a medium severity impact, and the vulnerability is not listed in CISA KEV. EPSS data is unavailable, so the risk of exploitation cannot be precisely quantified, but the public nature of the parameter autocompletion UI means it could be abused by both authenticated and unauthenticated users who can reach the web interface. The attack does not require local access – remote users with web UI access can trigger the autocompletion feature, revealing the credentials.