Skip to content
CVE PROGRAM SOURCE RECORD9.1 Critical

CVE-2026-97406

Authentication Bypass via Bearer Tokens to Unauthorized Credential Minting

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
certcc

Description

XERJ Console API bearer tokens can bypass the passkey‑only authentication requirement and directly invoke the API‑token creation endpoint, allowing unauthorized minting of persistent successor credentials.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Xerj Console API

  • v1.0.0-rc.11affected

References