Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-119446— Session fixation in the CLI login flow allows an unauthenticated attacker to obtain a user's API token

Quick assessment

Affected
nerves-hub nerves_hub_web
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 nerves-hub 项目的 nerves_hub_web 模块中，CLI 登录流程存在会话固定（Session Fixation）漏洞。未认证的攻击者可通过精心构造的登录链接，获取其他用户账户的 API 令牌。 具体流程如下：发起 CLI 登录时，向 发送请求无需身份验证，该请求会返回一个轮询令牌（polling token）、一个携带该令牌的确认 URL 以及一个确认码。当已登录的用户打开该 URL 并点击“确认”按钮后， 函数会为该用户账户生成一个 API 令牌，将其存储于登录会话中；随后，对 的下次轮询

CVSS 9.4 · Critical
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-119446

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Session fixation in the CLI login flow allows an unauthenticated attacker to obtain a user's API token
Source: CVE Program / CVE List V5
Vulnerability Description
Session Fixation vulnerability in the CLI login flow in nerves-hub nerves_hub_web allows an unauthenticated attacker to obtain an API token for another user's account via a crafted login link. Starting a CLI login with POST /api/auth/cli_session needs no authentication and returns a polling token, a confirmation URL that carries that token, and a confirmation code. When a signed-in user opens that URL and clicks Confirm, NervesHub.Accounts.verify_cli_session_token/2 creates an API token for the user's account and stores it on the login, and the next poll of GET /api/auth/cli_session/<token> returns it to whoever started the login. The confirmation code is only displayed and is never compared with anything, so it cannot show that the person confirming is the one who started the login. The confirm form carries a CSRF token and the page cannot be framed, so the attacker has to persuade the user to open the link and click the button themselves. This issue affects nerves_hub: from 2.5.0 before 2.5.3.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Source: CVE Program / CVE List V5
Vulnerability Type
会话固定
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
nerves-hub nerves_hub_web 2.5.0 ~ 2.5.3 cpe:2.3:a:nerves-hub:nerves_hub_web:*:*:*:*:*:*:*:*
nerves-hub nerves_hub_web 2.5.0 ~ 2.5.3 cpe:2.3:a:nerves-hub:nerves_hub_web:*:*:*:*:*:*:*:*
nerves-hub nerves_hub_web e6bf11a812d7aa8b69d854ba8ef02d65516f5564 ~ 3131f1701194b581ab4b3e5e9d81194fc9c83508 cpe:2.3:a:nerves-hub:nerves_hub_web:*:*:*:*:*:*:*:*

II. Public POCs for CVE-2026-119446

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-119446

请登录查看更多情报信息。

Other References for CVE-2026-119446 (5)

Same Patch Batch · nerves-hub · 2026-11-10 · 6 CVEs total

CVE-2026-120730 8.6 HIGH Mass assignment of organization, product and deployment group IDs allows users to write in
CVE-2026-120999 7.4 HIGH Improper authentication lets Google sign-in and confirmation links sign users in to accoun
CVE-2026-120295 7.1 HIGH Incorrect authorization in the devices page bulk move allows view-role members to move dev
CVE-2026-120286 5.3 MEDIUM Missing authorization in device and deployment group page events allows view-role members
CVE-2026-120997 2.3 LOW Improper session invalidation keeps removed or demoted members' open pages and device cons

IV. Related Vulnerabilities

Same product: nerves_hub_web
Same vendor: nerves-hub
Same weakness: CWE-384