YouTrack VCS Webhook Handler Allows Open Access with Blank Secret <2026.2.18634
CVE-2026-86486 Published on September 7, 2026
In JetBrains YouTrack before 2026.2.18634 the generic VCS webhook handler failed open when its secret was blank
Vulnerability Analysis
CVE-2026-86486 is exploitable with network access, and does not require authorization privileges or user interaction. This vulnerability is consided to have a high level of attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality, with no impact on integrity, and no impact on availability.
Weakness Type
Missing Authentication for Critical Function
The software does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
Products Associated with CVE-2026-86486
Want to know whenever a new CVE is published for JetBrains Youtrack? stack.watch will email you.
Affected Versions
JetBrains YouTrack:- Before 2026.2.18634 is affected.