View Ridge Security
Back to Cyber Hose

JetBrains YouTrack Cross-Tenant GitHub App Token Theft

A critical cross-tenant token theft vulnerability in JetBrains YouTrack affects many users and raises serious security concerns.

🕵️ RESEARCH & DEEP DIVES

  • Between Two Nerds: Can AI defend critical infrastructure? — Risky Business News

  • PEEP Turns Chrome and Edge Into Post-Compromise Backdoors for Host Command Execution — The Hacker News

  • Protocol::HTTP2 versions before 1.14 for Perl allow memory exhaustion via clo... — CVE ThreatInt

  • Net::IP::LPM versions before 1.12 for Perl accept malformed prefix lengthsNet... — CVE ThreatInt

  • In JetBrains GoLand before 2026.2.2.1 missing authentication on the GoLand pr... — CVE ThreatInt

  • In JetBrains IntelliJ IDEA before 2026.2.2 missing project-trust check leaked... — CVE ThreatInt

  • In JetBrains IntelliJ IDEA before 2026.2.2 missing project-trust confirmation... — CVE ThreatInt

  • In JetBrains IntelliJ IDEA before 2026.2.2 opening an untrusted project could... — CVE ThreatInt

  • In JetBrains IntelliJ IDEA before 2026.2.2 missing TLS and authentication on ... — CVE ThreatInt

  • In JetBrains IntelliJ IDEA before 2026.2.2 terminal command input could be wr... — CVE ThreatInt

  • In JetBrains YouTrack before 2026.1.14047 a missing escalation check let a us... — CVE ThreatInt

  • In JetBrains YouTrack before 2026.1.14047 predefined search fields leaked all... — CVE ThreatInt

  • In JetBrains YouTrack before 2025.3.160480, 2026.1.14047 pUT requests on link... — CVE ThreatInt

  • In JetBrains YouTrack before 2026.2.18769 changing a mailbox host without re-... — CVE ThreatInt

  • In JetBrains YouTrack before 2026.2.18769 missing access control on Helpdesk ... — CVE ThreatInt

  • In JetBrains YouTrack before 2026.2.18687 missing permission checks allowed c... — CVE ThreatInt

  • In JetBrains YouTrack before 2026.2.18634 cloning a whiteboard allowed unauth... — CVE ThreatInt

  • In JetBrains YouTrack before 2026.2.18634 improper permission checks allowed ... — CVE ThreatInt

  • In JetBrains YouTrack before 2026.2.18634 a shared token cache allowed cross-... — CVE ThreatInt

  • JetBrains YouTrack: Cross-Tenant GitHub App Token Theft (CVE-2026-86492) — thehackerwire.com (discovered)

Need help assessing your exposure?

Start with the free Posture Self-Check to see where you stand against the current threat landscape.

Free Posture Self-Check