CVE-2026-49381 LOW

CVE-2026-49381

Vendor Jetbrains

Product TeamCity

Weakness CWE-79 · XSS

Published May 29, 2026

Last update May 29, 2026

View on NVD All CVEs

CVSS base score

3.4/10

Attack vector Network

Attack complexity Low

Privileges required High

User interaction Required

Confidentiality Low

Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:N/A:N

What the vulnerability does

01Description

In JetBrains TeamCity before 2026.1 stored XSS on the SAML login page was possible

Key dates

02Disclosure timeline

May 29, 2026 CVE published

May 29, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-49381 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/79.html

Related vulnerabilities

04Related CVE

CVE-2021-21358 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in typo3/cms-form CVE-2023-20074 CVE-2024-4567 Themify Shortcodes <= 2.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via themify_button Shortcode CVE-2026-33517 MantisBT Vulnerable to Stored HTML Injection in Tag Delete Confirmation CVE-2025-26914 WordPress Variable Inspector plugin <= 2.6.2 - Reflected Cross Site Scripting (XSS) vulnerability