CVE-2026-56141
Received Received - Intake
Account Takeover via Predictable Restore Codes in JetBrains Hub

Publication date: 2026-06-19

Last updated on: 2026-06-19

Assigner: JetBrains s.r.o.

Description
In JetBrains Hub before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 account takeover via predictable restore codes was possible
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-06-19
Last Modified
2026-06-19
Generated
2026-06-21
AI Q&A
2026-06-19
EPSS Evaluated
N/A
NVD
CVE-2026-56141
EUVD
EUVD-2026-38006
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
jetbrains hub to 2026.1.13757 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-338 The product uses a Pseudo-Random Number Generator (PRNG) in a security context, but the PRNG's algorithm is not cryptographically strong.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability exists in JetBrains Hub versions before 2026.1.13757 and several earlier versions. It allows an attacker to take over user accounts by exploiting predictable restore codes.

Impact Analysis

The vulnerability can lead to a complete account takeover without requiring any privileges or user interaction. This means an attacker can gain unauthorized access to user accounts, potentially leading to loss of confidentiality, integrity, and availability of data and services.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-56141. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart