Technical impact
The vulnerability allows an attacker to spoof IP addresses via HTTP headers, enabling forged Bitbucket webhook requests received by the affected YouTrack server. Through this forgery the attacker could trigger actions that are normally restricted to legitimate Bitbucket webhooks. The weakness is a type of authentication bypass (CWE-291) and, while it does not permit arbitrary code execution, it opens a path to unauthorized operations performed by the YouTrack system.
Affected Systems
JetBrains YouTrack versions prior to 2026.2.18634 are affected. The issue was discovered in JetBrains YouTrack before the 2026.2.18634 release. Users must verify their installed version to determine if an update is required.
Risk and Exploitability
The CVSS score of 3.5 indicates low severity, and the EPSS score is not available, so no current insight into exploitation likelihood. The vulnerability is not listed in CISA's KEV catalog, indicating no known widespread exploitation. Because the flaw relies on HTTP header manipulation to spoof the source IP, an attacker would need network access to the YouTrack instance or ability to send HTTP traffic that reaches it. Once the forged header is accepted, the webhook may perform privileged actions on behalf of Bitbucket.
