CVE-2026-97406

CVE-2026-97406 · Authentication Bypass via Bearer Tokens to Unauthorized Credential Minting

This page contains facts from public vulnerability sources. Check the original advisory before updating.

XERJ Console API bearer tokens can bypass the passkey‑only authentication requirement and directly invoke the API‑token creation endpoint, allowing unauthorized minting of persistent successor credentials.

EPSS 0.3%

Published: 2026-10-20T18:11:08.475Z
Updated: 2026-10-20T19:07:07.888Z

Affected products and versions

console api
Versions
- v1.0.0-rc.11: Affected
No fix published

Original sources

https://kb.cert.org/vuls/id/645818
https://www.kb.cert.org/vuls/id/645818
https://nvd.nist.gov/vuln/detail/CVE-2026-97406

Check your server →

CVE-2026-97406 · Authentication Bypass via Bearer Tokens to Unauthorized Credential Minting

Affected products and versions

console api

Original sources