Stored XSS in JetBrains TeamCity SAML Login Page

Publication date: 2026-05-29

Last updated on: 2026-06-02

Assigner: JetBrains s.r.o.

Description

In JetBrains TeamCity before 2026.1 stored XSS on the SAML login page was possible

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-05-29

Last Modified

2026-06-02

Generated

2026-07-09

AI Q&A

2026-05-29

EPSS Evaluated

2026-07-08

NVD

CVE-2026-49381

EUVD

EUVD-2026-33389

Affected Vendors & Products

Vendor	Product	Version / Range
jetbrains	teamcity	to 2026.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This vulnerability is a stored Cross-Site Scripting (XSS) issue found in JetBrains TeamCity versions before 2026.1. It occurs on the SAML login page, where malicious scripts can be stored and later executed in the context of users visiting that page.

Impact Analysis

The impact of this vulnerability is limited due to its low CVSS score of 3.4. It requires network access, low attack complexity, and high privileges with user interaction. The vulnerability can lead to partial confidentiality loss but does not affect integrity or availability.

Hi! I’m here to help you understand CVE-2026-49381. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70