CVE-2026-120997— Improper session invalidation keeps removed or demoted members' open pages and device consoles working at their old role
Quick assessment
Affected
nerves-hub nerves_hub_web
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 nerves-hub 项目的 nerves_hub_web 模块中，仪表盘页面、设备控制台以及本地 Shell 通信通道存在会话失效不当（Improper Session Invalidation）漏洞。该漏洞允许被移除或降权的组织成员，通过其当时已打开的页面或会话，继续以原有角色执行操作。 具体而言，仪表盘页面在挂载时仅通过 NervesHubWeb.Auth 中的 assign_org_to_scope 钩子读取一次成员角色；而控制台、本地 Shell 及设备事件流通道则仅在加入时检查一次成员资格。因此，当
Possible ATT&CK Techniques 3 AI
T1098 · Account Manipulation T1078 · Valid Accounts T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-120997
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Improper session invalidation keeps removed or demoted members' open pages and device consoles working at their old role
Source: CVE Program / CVE List V5
Vulnerability Description
Improper Session Invalidation vulnerability in the dashboard pages, device console and local shell channels in nerves-hub nerves_hub_web allows an organization member who is removed or given a lower role to keep acting at their old role through anything they had open at the time. The dashboard reads the member's role once when a page mounts, in the assign_org_to_scope hook of NervesHubWeb.Auth, and the console, local shell and device event stream channels check membership once at join. Removing a member or changing their role tells none of them, so open pages keep carrying out actions and open consoles keep running commands on the device until the page reloads or the socket disconnects.
The dashboard also opens consoles over NervesHubWeb.UserSocket with a token that holds only the user's id, is accepted for 24 hours, and is not revoked by signing out, which disconnects only the session's LiveViews. Whoever holds a token taken from a page can open consoles as that user, within the user's current membership, until it expires.
This issue affects nerves_hub: from 1.0.0 before 2.5.3.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:L/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
CWE-1464
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| nerves-hub | nerves_hub_web | 1.0.0 ~ 2.5.3 |
cpe:2.3:a:nerves-hub:nerves_hub_web:*:*:*:*:*:*:*:*
|
|
| nerves-hub | nerves_hub_web | 1.0.0 ~ 2.5.3 |
cpe:2.3:a:nerves-hub:nerves_hub_web:*:*:*:*:*:*:*:*
|
|
| nerves-hub | nerves_hub_web | b5d2438677f79d10e91aeef20a7b5cd8cca0d63c ~ a96497ddd4d24ab1847f7685e255bf96fd87b85b |
cpe:2.3:a:nerves-hub:nerves_hub_web:*:*:*:*:*:*:*:*
|
|
II. Public POCs for CVE-2026-120997
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-120997
请登录查看更多情报信息。
Other References for CVE-2026-120997 (5)
-
https://github.com/nerves-hub/nerves_hub_web/security/advisories/GHSA-c7jf-qcx9-xxf8 vendor-advisory related
Same Patch Batch · nerves-hub · 2026-11-10 · 6 CVEs total
| CVE-2026-119446 | 9.4 CRITICAL | Session fixation in the CLI login flow allows an unauthenticated attacker to obtain a user |
| CVE-2026-120730 | 8.6 HIGH | Mass assignment of organization, product and deployment group IDs allows users to write in |
| CVE-2026-120999 | 7.4 HIGH | Improper authentication lets Google sign-in and confirmation links sign users in to accoun |
| CVE-2026-120295 | 7.1 HIGH | Incorrect authorization in the devices page bulk move allows view-role members to move dev |
| CVE-2026-120286 | 5.3 MEDIUM | Missing authorization in device and deployment group page events allows view-role members |
IV. Related Vulnerabilities
Same product: nerves_hub_web
-
CVE-2026-119446
Session fixation in the CLI login flow allows an unauthentic -
CVE-2026-120286
Missing authorization in device and deployment group page ev -
CVE-2026-120730
Mass assignment of organization, product and deployment grou -
CVE-2026-120999
Improper authentication lets Google sign-in and confirmation -
CVE-2026-120295
Incorrect authorization in the devices page bulk move allows
Same vendor: nerves-hub
-
CVE-2026-119446
Session fixation in the CLI login flow allows an unauthentic -
CVE-2026-120286
Missing authorization in device and deployment group page ev -
CVE-2026-120730
Mass assignment of organization, product and deployment grou -
CVE-2026-120999
Improper authentication lets Google sign-in and confirmation -
CVE-2026-120295
Incorrect authorization in the devices page bulk move allows