The vulnerability allows an attacker who can send queries directly to the JetBrains Hub database to bypass the normal authentication process. This defect, classified as CWE‑306, permits the attacker to assume any user identity, including that of an administrator, without needing valid credentials. The result is full control over the Hub instance, enabling configuration changes, data tampering, and potential lateral movement within an organization.

JetBrains Hub versions prior to 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, and 2024.2.148429 are affected. All releases below these version numbers have the authentication bypass flaw.

The CVSS score of 10 indicates critical severity, although the EPSS score is currently unavailable and the flaw is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is an attacker with the ability to query the database directly—either through exposed database ports, local system access, or compromised application credentials. If this access can be achieved, the attacker can immediately gain administrative privileges within the Hub container. The high CVSS score indicates that exploitation would have complete confidentiality, integrity, and availability impact on the affected environment.