Account takeover via predictable restore codes in JetBrains Hub before 2026.1.13757
CVE-2026-56141 Published on June 19, 2026

In JetBrains Hub before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 account takeover via predictable restore codes was possible

NVD

Vulnerability Analysis

CVE-2026-56141 can be exploited with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to be critical as this vulnerability has a high impact to the confidentiality, integrity and availability of this component.

Attack Vector:
NETWORK
Attack Complexity:
LOW
Privileges Required:
NONE
User Interaction:
NONE
Scope:
UNCHANGED
Confidentiality Impact:
HIGH
Integrity Impact:
HIGH
Availability Impact:
HIGH

Weakness Type

What is a PRNG Vulnerability?

The product uses a Pseudo-Random Number Generator (PRNG) in a security context, but the PRNG's algorithm is not cryptographically strong.

CVE-2026-56141 has been classified to as a PRNG vulnerability or weakness.


Products Associated with CVE-2026-56141

Want to know whenever a new CVE is published for JetBrains Hub? stack.watch will email you.

JetBrains Hub
 

Affected Versions

JetBrains Hub: