In JetBrains Datalore before 2026.4 missing expiration validation of account tokens allowed a new authenticated session
An attacker needs an account token that should no longer be valid because it has expired. The issue allows that expired token to establish a new authenticated session.
The provided information identifies affected JetBrains Datalore versions before 2026.4 and does not describe any configuration prerequisite. Token expiration validation is the relevant control.
Check the JetBrains Datalore version in use. Versions before 2026.4 are affected according to the provided information.
The provided information does not specify a workaround. Since exploitation relies on expired account tokens being accepted, invalidating or rotating existing account tokens may reduce exposure, but this is not stated as a confirmed mitigation.