JetBrains Hub versions prior to 2026.1.13757, including certain 2025 and 2024 versions, contain an authentication bypass vulnerability (CWE-306) that can be exploited via direct database access. This flaw permits an attacker to bypass authentication mechanisms and obtain administrative access to the system. The vulnerability has a critical CVSS 3.1 score of 10.0, indicating network attack vector, low complexity, no privileges required, no user interaction, and complete confidentiality, integrity, and availability impact. No vendor advisory or patch information is available at this time, and the product is not a cloud service, so remediation is the responsibility of the user.

Successful exploitation allows an unauthenticated attacker with direct database access to bypass authentication controls and gain full administrative privileges on JetBrains Hub. This results in complete compromise of confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or mitigation is currently documented, users should restrict direct database access to trusted personnel and environments only. Monitor vendor channels for updates and apply patches promptly once available.