JetBrains TeamCity versions prior to 2026.1 implement a stored cross‑site scripting (XSS) flaw on the SAML login page. The vulnerability allows an attacker to inject malicious scripts that are persisted and subsequently delivered to users who view the page. This can lead to session hijacking, credential theft, or page defacement, directly affecting confidentiality and integrity of user data. The weakness is classified as CWE‑79.

JetBrains TeamCity is impacted. All installations using TeamCity before the 2026.1 release are vulnerable; no additional vendor or product variants are listed.

The CVSS score of 3.4 indicates a low severity score, and the EPSS score is currently unavailable, suggesting limited information about real‑world exploitation. The vulnerability is not recorded in the CISA KEV catalog. The likely attack vector is a stored XSS vector on the SAML login page, which would require an attacker to submit malicious input that gets stored by the application and later rendered to a victim’s browser. Without additional advanced exploitation requirements, the risk is primarily limited to the users who interact with the compromised login page.