This vulnerability in JetBrains YouTrack occurs because the generic VCS webhook handler does not properly enforce authentication when the secret is left blank. As a result, the handler fails open, potentially allowing unauthenticated requests to be accepted. The CVSS score is 3.7 (low severity), reflecting low impact on confidentiality and availability but some impact on integrity. No official patch or remediation level has been confirmed in the provided data, and no known exploits are reported in the wild.

The vulnerability could allow unauthorized users to send webhook requests that are accepted by YouTrack's VCS webhook handler if the secret is blank. This may lead to limited integrity impact, such as unauthorized triggering of webhook-related actions. There is no impact on confidentiality or availability according to the CVSS vector. No active exploitation is known.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, ensure that webhook secrets are not left blank to avoid the handler failing open. Follow any vendor instructions once published.