critical9.8Known exploitedPublic exploit code
CVE-2024-27198
JetBrains TeamCity Authentication Bypass Vulnerability
Exploited in the wild
This vulnerability is on a Known Exploited Vulnerabilities catalogue, added 2024-03-07. Federal due date: 2024-03-28.
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- JetBrains TeamCity 2023.11.4 - Authentication Bypass2025-08-11 · webapps · multiple
Impact
In JetBrains TeamCity before 2023.11.4 authentication bypass allowing to perform admin actions was possible
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Jetbrains | Teamcity | before 2023.11.4 |
Weakness classification
References
- NVD record
- CVE.org record
- CISA KEV catalog
- https://www.darkreading.com/cyberattacks-data-breaches/jetbrains-teamcity-mass-exploitation-underway-rogue-accounts-thrive
- https://www.jetbrains.com/privacy-security/issues-fixed/
- https://www.darkreading.com/cyberattacks-data-breaches/jetbrains-teamcity-mass-exploitation-underway-rogue-accounts-thrive
- https://www.jetbrains.com/privacy-security/issues-fixed/
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-27198