JetBrains Hub versions prior to 2026.1.13757, including certain 2025 and 2024 releases, are vulnerable to account takeover due to predictable restore codes. This weakness stems from the use of cryptographically weak pseudo-random number generation (CWE-338), allowing attackers to potentially guess or predict restore codes and gain unauthorized access. The vulnerability is rated critical with a CVSS 3.1 base score of 9.8, reflecting network attack vector, low attack complexity, no privileges or user interaction required, and full impact on confidentiality, integrity, and availability. No official remediation or patch information is currently available from the vendor.

Successful exploitation allows an attacker to take over user accounts by predicting restore codes, leading to full compromise of affected accounts. This impacts confidentiality, integrity, and availability of user data and services within JetBrains Hub. The vulnerability is critical and can be exploited remotely without authentication or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to JetBrains Hub instances, monitor for suspicious activity, and follow any interim recommendations provided by JetBrains. Avoid relying on restore codes for account recovery if possible.