CVE-2026-49381

LowCVSS 3.4

Published: 29/05/2026(UTC)Updated: 22/07/2026(UTC)Translated: 23/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.21%

11th percentile - higher than 11% of all known CVEs

Summary

A stored cross-site scripting vulnerability was found in JetBrains TeamCity before 2026.1 on the SAML login page. Attackers can inject a malicious script that executes on each login.

Risk Assessment

The risk is theft of credentials or session hijacking for users logging in via SAML.

Recommendation

Immediately update JetBrains TeamCity to version 2026.1 or later.

Original NVD description (English source)

In JetBrains TeamCity before 2026.1 stored XSS on the SAML login page was possible