JetBrains YouTrack <2026.2.18634: IP Spoofing via Headers Bitbucket Webhooks
CVE-2026-86485 Published on September 7, 2026
In JetBrains YouTrack before 2026.2.18634 iP spoofing via HTTP headers allowed forged Bitbucket webhooks
Vulnerability Analysis
CVE-2026-86485 can be exploited with local system access, requires user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a small impact on confidentiality, a small impact on integrity and availability.
Weakness Type
Reliance on IP Address for Authentication
The software uses an IP address for authentication. IP addresses can be easily spoofed. Attackers can forge the source IP address of the packets they send, but response packets will return to the forged IP address. To see the response packets, the attacker has to sniff the traffic between the victim machine and the forged IP address. In order to accomplish the required sniffing, attackers typically attempt to locate themselves on the same subnet as the victim machine. Attackers may be able to circumvent this requirement by using source routing, but source routing is disabled across much of the Internet today. In summary, IP address verification can be a useful part of an authentication scheme, but it should not be the single factor required for authentication.
Products Associated with CVE-2026-86485
Want to know whenever a new CVE is published for JetBrains Youtrack? stack.watch will email you.
Affected Versions
JetBrains YouTrack:- Before 2026.2.18634 is affected.