CVE-2026-86478: JetBrains Youtrack

Critical severity, CVSS 9.8. EPSS: 0.6% chance of exploitation in the next 30 days.

In JetBrains YouTrack before 2025.3.161254, 2026.1.14042 improper authentication in YouTrack Helpdesk allowed unauthenticated account takeover via a self-asserted email address

Affected products

• JetBrains Youtrack

Published 2026-09-07. Last modified 2026-09-09.