Xerj Console API bypass lets token holders mint credentials
CVE-2026-97406 lets a valid API token spawn persistent successor credentials that survive parent-token revocation; no patch is available.
1
1 stories, newest first · one card per story
CVE-2026-97406 lets a valid API token spawn persistent successor credentials that survive parent-token revocation; no patch is available.
Today 1.7K readers · 3.4K views · 2.6K reads · all time 161K views