In JetBrains Toolbox App before 2.6 the SSH plugin established connections without sufficient user confirmation
CWE-304, CWE-304