JetBrains IntelliJ IDEA Credentials Disclosure Vulnerability via Remote Reference

A vulnerability allowing credentials disclosure was identified in JetBrains IntelliJ IDEA versions prior to 2025.2. This issue arose from the built-in web server leaking information about open projects, which could be exploited by sending a crafted request that referenced a project with sensitive data. The vulnerability was reported by a JetBrains user.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive credentials, such as GitHub access tokens, which could be exposed to third-party sites.

Reproduction

To reproduce this vulnerability, open a project in JetBrains IntelliJ IDEA version prior to 2025.2. The built-in web server will automatically leak information about the project, including sensitive credentials, through an unsecured HTTP connection. This can be exacerbated by crafting a request that references a project containing sensitive data.

Remediation

Users can update to JetBrains IntelliJ IDEA version 2025.2 or later, where this vulnerability has been fixed.