CVE-2026-97406

Deferred Deferred - Pending Action

XERJ Console API Token Authentication Bypass

Publication date: 2026-10-20

Last updated on: 2026-10-29

Assigner: CERT/CC

Description

XERJ Console API bearer tokens can bypass the passkey‑only authentication requirement and directly invoke the API‑token creation endpoint, allowing unauthorized minting of persistent successor credentials.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-20

Last Modified

2026-10-29

Generated

2026-11-10

AI Q&A

2026-10-21

EPSS Evaluated

2026-11-08

NVD

CVE-2026-97406

EUVD

EUVD-2026-105251

Affected Vendors & Products

Vendor	Product	Version / Range
Xerj	Console API	v1.0.0-rc.11

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

CVE-2026-97406 is an authentication bypass flaw in the Xerj Console API. Attackers can exploit improper session state handling to create unauthorized persistent credentials. The issue occurs when both browser sessions and API tokens are converted into a generic AuthSession object without verifying passkey-backed authentication. This allows attackers with a valid token to generate successor credentials with identical access levels, even after the original token is revoked.

Detection Guidance

Detecting this vulnerability requires monitoring for unauthorized API token creation and suspicious credential generation. Check logs for repeated API calls to the token creation endpoint, especially from unexpected sources. Look for tokens with unusual lifespans or hierarchical relationships indicating descendant credentials. Review administrative actions like account invitations or passkey enrollments not initiated by authorized users.

Impact Analysis

If exploited, attackers can gain full administrative control of the Xerj instance, issue new account invitations, and enroll their own passkeys. This results in permanent access to the system and its data. Even after token revocation, compromised tokens can spawn descendant tokens that remain active indefinitely.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, potentially violating GDPR's data protection requirements and HIPAA's safeguards for protected health information. Unauthorized credential creation may result in data breaches, non-compliance with access control mandates, and failure to maintain audit logs of legitimate access.

Mitigation Strategies

Monitor the Xerj Console API for unauthorized token creation events. Revoke all existing tokens and sessions immediately. Restrict API access to trusted IPs only. Check for signs of administrative account compromise, such as new passkey enrollments or account invitations.

Hi! I’m here to help you understand CVE-2026-97406. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...