JetBrains YouTrack versions prior to 2026.1.13757, as well as specific 2025 and 2024 versions, contain an authentication bypass vulnerability (CWE-306) that can be exploited through direct database access. This bypass leads to unauthorized administrative access, posing a critical security risk. The vulnerability is publicly documented with a CVSS 3.1 base score of 10.0, indicating network attack vector, no required privileges or user interaction, and complete confidentiality, integrity, and availability impact. No patch or official remediation level has been disclosed by JetBrains as of the publication date.

Successful exploitation allows an unauthenticated attacker with direct database access to bypass authentication controls and gain administrative privileges in YouTrack. This compromises confidentiality, integrity, and availability of the affected system, enabling full control over the application and its data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict direct database access to trusted administrators only and monitor for unauthorized access attempts. Follow JetBrains' official channels for updates on patches or mitigations.