CVE-2026-49381: Stored XSS in JetBrains TeamCity SAML Login

Technical summary

This is a stored XSS vulnerability (CWE-79) in TeamCity's SAML authentication endpoint. The flaw allows a high-privileged attacker to persist malicious JavaScript in the SAML login page context. When users visit the affected page, the injected script executes with the privileges of that user's session. The network attack surface is low complexity, suggesting the injection point is straightforward once privileged access is obtained. The vulnerability does not permit privilege escalation or system compromise; its impact is confined to session-scoped information disclosure on the client side.

Business impact

Organizations using TeamCity for CI/CD automation may experience reduced user confidence in their authentication system if this vulnerability is exploited. An insider or compromised administrator could inject convincing phishing content or session-stealing payloads into the SAML login page, potentially harvesting credentials or tokens. However, the requirement for high-level privileges significantly limits opportunistic exploitation. The low CVSS score reflects that this is primarily a supply-chain or insider-threat risk rather than a vector for broad system compromise.

Affected systems

JetBrains TeamCity versions prior to 2026.1 are affected. Organizations running TeamCity deployments with SAML authentication enabled are in scope. The vulnerability does not affect non-SAML authentication methods. Verify your running version against vendor advisories to confirm whether your deployment is within the vulnerable range.

Exploitability

Exploitation requires high-level administrative or system access within TeamCity, making mass exploitation unlikely. An attacker must already have sufficient privileges to inject content into the SAML login page—a capability typically restricted to admins. The vulnerability is not listed on CISA's Known Exploited Vulnerabilities catalog, indicating no public evidence of active weaponization or in-the-wild attacks. Opportunistic scanning or unauthenticated exploitation is not feasible.

Remediation

Upgrade JetBrains TeamCity to version 2026.1 or later, which resolves the stored XSS vulnerability on the SAML login page. Review access controls to ensure that only trusted administrators have the ability to modify TeamCity configuration and authentication settings. Validate that your SAML identity provider configuration is correct and that no unexpected modifications have been made to the login interface.

Patch guidance

JetBrains has addressed this vulnerability in TeamCity 2026.1. Consult the official JetBrains TeamCity release notes and security advisories to confirm the exact version and any compatibility considerations before deployment. Plan the upgrade during a maintenance window, as it may require a brief service restart. Test the upgrade in a non-production environment first to verify that SAML authentication continues to function correctly.

Detection guidance

Monitor TeamCity audit logs for unexpected modifications to SAML login page configuration or authentication settings, particularly changes made by administrative accounts. Review browser console logs and HTTP responses from the SAML login endpoint for injected script tags or suspicious JavaScript. Implement content security policy (CSP) headers on the TeamCity login page to mitigate the impact of any stored XSS. Perform regular security reviews of admin access and look for unusual privilege elevation or account activity patterns.

Why prioritize this

Although this vulnerability carries a low CVSS score, it warrants attention in organizations where TeamCity administrators are not fully trusted or where SAML login pages are exposed to a wider user base. The fixed version is readily available, and remediation is straightforward. Prioritize this for environments with strict authentication security policies or those that have experienced prior insider threats. For most organizations, standard patching schedules are appropriate.

Risk score, explained

The CVSS 3.1 score of 3.4 (LOW) reflects the limited attack surface: high privileges are required, user interaction is necessary, and the impact is confined to confidentiality within a single session. There is no attack vector for authentication bypass, denial of service, or system-level compromise. The stored nature of the XSS elevates concern beyond a reflected variant, but the privilege barrier prevents this from being a critical issue.

Frequently asked questions