CVE-2026-100260 in YouTrack
Summary
by MITRE • 09/30/2026
In JetBrains YouTrack before 2026.2.18991 mailbox integration allowed authentication after a password reset
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/30/2026
The vulnerability identified in JetBrains YouTrack prior to version 2026.2.18991 represents a critical flaw within the application's identity and access management subsystem, specifically concerning the interaction between user account recovery mechanisms and external mailbox integrations. This issue stems from an improper handling of authentication state transitions during password reset operations. When a user initiates a password reset process, the system is designed to invalidate existing session tokens and require re-authentication with new credentials. However, due to a logic error in how the application validates the integrity of linked external mail accounts against the updated security context, it was possible for an attacker or even a legitimate user under specific timing conditions to bypass this requirement. The core technical flaw lies in the failure to properly revoke or invalidate authentication tokens associated with mailbox integration services when a password change event occurs. This results in a state where the application continues to accept requests authenticated via the legacy token, effectively treating the account as still active and authorized despite the credential update intended to secure it.
From an operational perspective, this vulnerability allows for unauthorized access to user accounts through their linked email integrations. If an attacker has obtained or can guess valid mailbox credentials that are integrated with YouTrack, they could potentially maintain persistent access even after the primary account password has been changed by the legitimate owner. This undermines the fundamental security assumption that changing a password immediately terminates all active sessions and invalidates prior authentication artifacts. The impact is particularly severe in environments where email-based notifications or integrations are used for critical workflow automation, issue tracking updates, or automated ticketing systems. An attacker leveraging this flaw could continue to receive sensitive information via email triggers associated with the account, potentially leading to data exfiltration if those emails contain confidential project details, code snippets, or internal communications. Furthermore, it complicates incident response efforts because standard remediation steps like password resets do not immediately neutralize the threat vector provided by the mailbox integration token.
This vulnerability aligns closely with CWE-613, which describes insufficient session expiration, as well as CWE-287, improper authentication, specifically in the context of credential update handling. In terms of the MITRE ATT&CK framework, this behavior facilitates Account Manipulation and potentially Persistence if an attacker uses the mailbox integration to maintain a foothold after initial compromise detection or password changes intended to remove them. The flaw highlights a common architectural oversight where secondary authentication channels are not synchronized with primary identity provider state changes. To mitigate this risk, organizations running affected versions of YouTrack must upgrade immediately to version 2026.2.18991 or later, which includes the necessary patches to ensure that mailbox integration tokens are properly invalidated upon password reset events. Administrators should also enforce strict session management policies and consider implementing multi-factor authentication for all user accounts to add an additional layer of verification that is less susceptible to token replay attacks. Regular auditing of active sessions and integrated services can help detect any anomalous activity resulting from this vulnerability before it leads to a full account compromise.