CVE-2026-123848
Received Received - Intake

Host Name Verification Bypass in JetBrains IntelliJ IDEA

Publication date: 2026-11-06

Last updated on: 2026-11-06

Assigner: JetBrains s.r.o.

Description
In JetBrains IntelliJ IDEA before 2026.3 host name verification was missing for server TLS certificates

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-06
Last Modified
2026-11-06
Generated
2026-11-06
AI Q&A
2026-11-06
EPSS Evaluated
N/A
NVD
CVE-2026-123848
EUVD
EUVD-2026-118351

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
JetBrains IntelliJ IDEA From 0 (inc) to 2026.3 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-297 The product communicates with a host that provides a certificate, but the product does not properly ensure that the certificate is actually associated with that host.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability exists in JetBrains IntelliJ IDEA versions before 2026.3 where server TLS certificates are not properly verified for host names during secure connections. This means an attacker could potentially intercept or manipulate communications between the IDE and remote servers by presenting a fraudulent TLS certificate.

Impact Analysis

An attacker could exploit this to perform man-in-the-middle attacks, stealing sensitive data like authentication tokens or code repositories. Developers using affected versions might unknowingly connect to malicious servers, risking data exposure or unauthorized access to their projects.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, violating GDPR's data protection requirements or HIPAA's safeguards for protected health information. Organizations using affected versions may fail compliance audits due to inadequate TLS certificate verification.

Mitigation Strategies

Update JetBrains IntelliJ IDEA to version 2026.3 or later to ensure host name verification for server TLS certificates is enabled.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-123848. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...