CVE-2026-86698— Refresh tokens accepted as private repository credentials at the CDN
Quick assessment
Affected
hexpm hexpm
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Insufficient Session Expiration vulnerability in OAuth token issuance in hexpm hexpm allows a user whose organization membership or session has ended to keep reading the organization's private packages and their documentation tarballs via a retained refresh to
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-86698
Vulnerability Information
Shenlong is analyzing...
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Refresh tokens accepted as private repository credentials at the CDN
Source: CVE Program / CVE List V5
Vulnerability Description
Insufficient Session Expiration vulnerability in OAuth token issuance in hexpm hexpm allows a user whose organization membership or session has ended to keep reading the organization's private packages and their documentation tarballs via a retained refresh token.
generate_refresh_token/4 in lib/hexpm/oauth/jwt.ex signs the refresh token with the same iss, aud and scope claims as the access token, so it carries the same repository:<org> scopes. The CDN service that serves private repositories verifies the signature and time claims and then authorizes from the scope claim, with no database lookup and no way to tell the two token kinds apart. Removing a member or revoking a session therefore takes effect at the CDN only when the 30 day refresh token expires, instead of after the 30 minute access token lifetime. Access is read-only and limited to organizations the account belonged to when the token was granted.
This issue affects hex.pm: from 2025-10-10 before 2026-09-22.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
不充分的会话过期机制
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-86698
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-86698
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-86698 (2)
Other References for CVE-2026-86698 (3)
-
EEF-CVE-2026-86698 - OSV related
-
CVE-2026-86698 related
IV. Related Vulnerabilities
Same product: hexpm
-
CVE-2026-75554
Explicit organization scopes survive token refresh after mem -
CVE-2026-75542
OAuth token exchange grants repository scopes for organizati -
CVE-2026-23940
Denial of Service via Oversized Package Upload -
CVE-2026-21622
Password Reset Tokens Do Not Expire -
CVE-2026-21621
Improper Scope Enforcement in OAuth client_credentials Flow
Same vendor: hexpm
-
CVE-2026-75554
Explicit organization scopes survive token refresh after mem -
CVE-2026-75542
OAuth token exchange grants repository scopes for organizati -
CVE-2026-32148
Lockfile checksums not verified in Hex allows dependency int -
CVE-2026-23940
Denial of Service via Oversized Package Upload -
CVE-2026-21622
Password Reset Tokens Do Not Expire
Same weakness: CWE-613
-
CVE-2026-77519
MaxKB: Expired application API keys remain usable on `/chat/ -
CVE-2026-86473
Apache Airflow: Logout ignores a presented Authorization bea -
CVE-2026-92976
Stored Cross-Site Scripting (XSS) in T-Systems’ TAO 2.0 -
CVE-2026-86533
Revoked session accepted because the session jti is never ch -
CVE-2026-81637
Replayable OAuth2 CSRF state retained after a failed callbac
V. Comments for CVE-2026-86698
No comments yet