CVE-2026-120997
Received Received - Intake

Session Fixation in NervesHub Web Dashboard

Publication date: 2026-11-10

Last updated on: 2026-11-10

Assigner: EEF

Description
Improper Session Invalidation vulnerability in the dashboard pages, device console and local shell channels in nerves-hub nerves_hub_web allows an organization member who is removed or given a lower role to keep acting at their old role through anything they had open at the time. The dashboard reads the member's role once when a page mounts, in the assign_org_to_scope hook of NervesHubWeb.Auth, and the console, local shell and device event stream channels check membership once at join. Removing a member or changing their role tells none of them, so open pages keep carrying out actions and open consoles keep running commands on the device until the page reloads or the socket disconnects. The dashboard also opens consoles over NervesHubWeb.UserSocket with a token that holds only the user's id, is accepted for 24 hours, and is not revoked by signing out, which disconnects only the session's LiveViews. Whoever holds a token taken from a page can open consoles as that user, within the user's current membership, until it expires. This issue affects nerves_hub: from 1.0.0 before 2.5.3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-10
Last Modified
2026-11-10
Generated
2026-11-10
AI Q&A
2026-11-10
EPSS Evaluated
N/A
NVD
CVE-2026-120997
EUVD
EUVD-2026-120872

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
nerves-hub nerves_hub_web From 1.0.0 (inc) to 2.5.3 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an improper session invalidation issue in nerves-hub nerves_hub_web. When an organization member is removed or demoted, their open dashboard pages, device consoles, and local shell channels retain their original permissions until the page reloads or the connection disconnects. The system checks the member's role only once at initial load or connection, not during subsequent actions. Additionally, dashboard console access uses a 24-hour token that remains valid even after logout, allowing unauthorized access if the token is stolen.

Detection Guidance

Check for open sessions, consoles, or device connections from removed or demoted users by monitoring active connections in the NervesHub Web dashboard and device channels. Look for persistent sessions that should have been invalidated after role changes.

Impact Analysis

If you are an organization admin, a removed or demoted member could continue performing actions or running commands on devices through open sessions. If you are a user, your session token could be stolen and used to access consoles as you for up to 24 hours, even after you sign out. This allows unauthorized access to sensitive device operations.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data or device operations, violating principles of least privilege and data protection. For GDPR, it risks unauthorized processing of personal data. For HIPAA, it may allow unauthorized access to protected health information. Organizations must ensure proper session invalidation to maintain compliance.

Mitigation Strategies
  • Upgrade to NervesHub Web version 2.5.3 or later to apply the patch for proper session invalidation.
  • Restart web nodes after any membership changes to force session revalidation.
  • Rotate the SECRET_KEY_BASE to invalidate all existing tokens and force reauthentication.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-120997. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...