hex.pm OAuth Token Exchange Privilege Escalation to Read Private Packages (CVE-2026-75542)

Vulnerability Overview This vulnerability involves OAuth token exchange granting organization-level permissions that the principal is not authorized to access. Specifically, an API key carrying permissions can be exchanged via the OAuth grant to obtain a token targeting any organization. Since the CDN edge does not query the database when authorizing repository access based on the token's scope claim, the token gains access to read private packages within organizations without going through the application logic. This means any registered account can create such a key; an attacker needs only one account and no affiliation with the target organization. Impact Scope CVSS Score: 8.3/10 Vulnerability Type: OAuth Token Exchange Impact: Any hex.pm account holder can read private packages from any organization on the service without requiring membership, invitations, or any interaction with that organization. Access persists for the lifetime of the token and remains invisible to the application because the CDN edge reads directly from the database. Remediation Patch Versions: Fix Details: Fixed the matching logic for organization names against the principal's own access, switching from prefix matching to exact matching. This ensures public repositories remain accessible to everyone while dropping external organization scopes during token issuance. Consequently, any organization-scoped token will be rejected, regardless of the granted scopes. POC Code References Introduction of check: Patch commit: Organization key variant enabled: Introduction of edge scope validation: Additional Information CVE ID: CVE-2026-75542 Weakness: CWE-863 Credits: - Fix Developer: - Coordinator: Summary This vulnerability allows attackers to gain access to private packages from organizations via OAuth token exchange, affecting a wide scope. A fix has been released, and relevant POC code is provided.

Goal Reached Thanks to every supporter — we hit 100%!

hex.pm OAuth Token Exchange Privilege Escalation to Read Private Packages (CVE-2026-75542)

More from this source