CVE-2026-86698
Received Received - Intake

Insufficient Session Expiration in HexPM OAuth Tokens

Publication date: 2026-09-22

Last updated on: 2026-09-22

Assigner: EEF

Description
Insufficient Session Expiration vulnerability in OAuth token issuance in hexpm hexpm allows a user whose organization membership or session has ended to keep reading the organization's private packages and their documentation tarballs via a retained refresh token. generate_refresh_token/4 in lib/hexpm/oauth/jwt.ex signs the refresh token with the same iss, aud and scope claims as the access token, so it carries the same repository:<org> scopes. The CDN service that serves private repositories verifies the signature and time claims and then authorizes from the scope claim, with no database lookup and no way to tell the two token kinds apart. Removing a member or revoking a session therefore takes effect at the CDN only when the 30 day refresh token expires, instead of after the 30 minute access token lifetime. Access is read-only and limited to organizations the account belonged to when the token was granted. This issue affects hex.pm: from 2025-10-10 before 2026-09-22.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-22
Last Modified
2026-09-22
Generated
2026-09-22
AI Q&A
2026-09-22
EPSS Evaluated
N/A
NVD
CVE-2026-86698
EUVD
EUVD-2026-84539

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
hexpm hexpm From 2025-10-10 (inc) to 2026-09-22 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-613 According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an Insufficient Session Expiration issue in the OAuth token system of hexpm. It allows former organization members or users with revoked sessions to continue accessing private packages and documentation via a retained refresh token. The refresh token carries the same repository scopes as an access token and is accepted by the CDN without distinguishing token types or checking revocation status.

Detection Guidance

Check for unauthorized access to private packages or documentation tarballs by reviewing CDN logs for JWT tokens with repository scopes. Look for tokens issued before 2026-09-22 that remain active beyond the intended 30-minute access token lifetime.

Impact Analysis

If you were previously part of an organization on hex.pm, your old refresh token could still grant read-only access to private packages and documentation for up to 30 days after leaving or revocation. This happens even if your account is removed or session is terminated, as the CDN does not validate token revocation.

Mitigation Strategies
  • Rotate all refresh tokens issued between 2025-10-10 and 2026-09-22 to invalidate retained tokens.
  • Revoke and reissue access tokens for all users in affected organizations.
  • Update hexpm to the patched version to prevent future token misuse.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-86698. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart