Xerj Console API bypass lets token holders mint credentials
CVE-2026-97406 lets a valid API token spawn persistent successor credentials that survive parent-token revocation; no patch is available.
64
CVE-2026-97406
- CVSS 3.1
- 9.1 critical
- EPSS
- —
- Published
- ·
- Modified
Description · NVD
XERJ Console API bearer tokens can bypass the passkey‑only authentication requirement and directly invoke the API‑token creation endpoint, allowing unauthorized minting of persistent successor credentials.
- Weakness
- CWE-306, CWE-863
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N