CVE-2026-100260 describes a vulnerability in JetBrains YouTrack's mailbox integration feature prior to version 2026.2.18991. The flaw allows authentication to persist after a password reset, potentially enabling unauthorized access or actions. This is categorized under CWE-1188, which involves improper authentication state management. The CVSS 3.1 base score is 5.3, indicating a medium severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed. Confidentiality impact is none, integrity impact is low, and availability impact is none.

The vulnerability could allow an attacker to continue authenticating via mailbox integration even after the legitimate user has reset their password. This could lead to unauthorized integrity-impacting actions within YouTrack. There is no impact on confidentiality or availability. No known exploits are reported in the wild.

A fix is available in JetBrains YouTrack version 2026.2.18991. Users should upgrade to this version or later to remediate the vulnerability. Since this is not a cloud service, remediation depends on user action to apply the update.