SQL-92 says, that the IN predicate always needs the parenthesis around it's value list. See http://www.contrib.andrew.cmu.edu/~shadow/sql/sql1992.txt on page 211 for reference.

Now the problem is, that the algorithm for checking whether brackets are needed or not is wrong. The algorithm is implemented in `org.hibernate.internal.util.StringHelper.replace`.
I will provide a fix for that in a few minutes including a backport for the 4.x branch.