CVE-2023-42793JetBrains TeamCity 2023 authentication bypass to RCE
What broke
TeamCity On-Premises before 2023.05.4 accepted an unauthenticated request that created an administrator token, then ran code. Discovered by Sonar. CVSS 9.8. Published 19 September 2023. CISA later confirmed Russian state use from that month. Cloud was not affected.
Why it matters
This is the CVE that taught a lot of identity and AppSec teams that CI credentials are production identity. CVE-2024-27198 and our 2026 TeamCity note are sequels. If you still have a public TeamCity, this history is your briefing.
What to do
- You should already be far past 2023.05.4. If a forgotten 2023.x appliance is still up, take it down and rotate every secret it held.
- Review admin users and SSH agent keys created in September 2023.
- Keep TeamCity off the internet. The 2024 and 2026 IDs assume you did not learn this once.
After you patch
A build system holds the credentials to ship your software, so an unauthenticated bypass here is a software supply chain event rather than one compromised host.
- Rotate every secret the server held: signing keys, registry and cloud credentials, deploy tokens, and any service account it authenticated as.
- Review build history for injected steps during the exposure window, and compare published artifacts against expected hashes.
- Revoke sessions and administrative tokens rather than only resetting passwords.
- Check for accounts and API tokens created during the window, which is the standard persistence step after this class of bypass.
Sources
- NVD: CVE-2023-42793
- CISA KEV / December 2023 update
- Sonar / JetBrains advisories
Related identity CVEs
Related on Start with Identity
- CVETeamCity agent-polling protocol authentication bypass to RCE
Every on-premises TeamCity version was vulnerable. An unauthenticated attacker abuses the agent polling channel and runs OS commands as the server. Fixed 27 Jul
- CVEConnectWise ScreenConnect auth bypass via an alternate path
ScreenConnect 23.9.7 and earlier skipped authentication on an alternate setup path (CWE-288). Attackers created admin users within hours. CISA KEV. CVSS 10.0. P
- CVEFortiWeb auth bypass and path traversal, admin creation
FortiWeb authentication bypass plus path traversal that lets an attacker create an admin. CVSS 9.8. Added to CISA KEV around 14 November 2025, before the Decemb
- BlogA CVE ID is a name. The value is knowing who the attacker becomes.
We opened a practitioner catalog of identity CVEs: what broke, why IAM teams should care, and what to do this week. Not an NVD mirror. A place to triage SAML wr
- BreachOkta's 2023 support-system breach: when your IdP gets phished
How attackers used a stolen credential to read Okta support cases and harvest session tokens, why HAR files were the weak link, and what it taught the industry