This vulnerability involves an open redirect in the SAML plugin of JetBrains TeamCity prior to version 2026.1. Open redirect vulnerabilities occur when an application accepts untrusted input that causes it to redirect users to external URLs without proper validation. This can potentially be used in phishing or social engineering attacks to redirect users to malicious sites. The CVSS 3.1 base score is 3.1, reflecting low impact due to high attack complexity and required user interaction, with no confidentiality or availability impact and only low integrity impact.

The impact is limited to potential redirection of users to unintended external websites, which could facilitate phishing or social engineering attacks. There is no direct impact on confidentiality or availability. Integrity impact is low. No known exploitation in the wild has been reported.

No official patch or remediation level has been published by JetBrains as of now. Users should monitor the vendor's advisories for updates and apply the TeamCity 2026.1 update or later once available, as the vulnerability affects versions before 2026.1. Until a fix is released, caution should be exercised when clicking on URLs related to the SAML plugin in affected versions.