CVE-2026-56141

In JetBrains Hub before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 account takeover via predictable restore codes was possible

Scoring

Severity

CRITICAL

CVSS base score

9.8

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS probability

0.52%

CWE

CWE-338

Published

2026-06-19

Last modified

2026-06-24

Affected products

• JetBrains Hub

Weakness type

• CWE-338

Related vulnerabilities

• CVE-2026-74887 — openssl_encrypt before 1.4.0 Insecure Random Import in PQC Module
• CVE-2026-74874 — openssl_encrypt before 1.4.0 Weak PRNG Steganography Pixel Selection
• CVE-2026-73567 — sm-crypto: Predictable SM2 key generation in Node.js: default RNG uses Math.random + wall clock
• CVE-2026-18611 — Data-science-pipelines-operator: dspo: cryptographically weak secret generation (math/rand) for db and s3 credentials
• CVE-2026-71851 — crypto-js: Insufficient Entropy in Cryptographic Secret Generation via Vulnerable CryptoJS Dependency Chain
• CVE-2026-9205 — Langflow is affected by weaknesses in secret handling and sensitive configuration access
• CVE-2026-64798 — Joomla Extension - regularlabs.com - Insecure login URL keys in IP login extension
• CVE-2026-16615 — Librest: weak random number generation in pkce implementation

Markdown version · Browse all CVEs