EUVD-2026-65119Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network endpoint requiring a valid API key (PR:L); scope change (S:C) because token crosses into a separate organization's trust domain; no integrity or availability impact.
Primary rating from Vendor (EEF).
CVSS VectorVendor: EEF
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
Incorrect Authorization vulnerability in the OAuth token endpoint in hexpm hexpm allows an API key holding the repositories permission to read another organization's private packages.
When an API key is exchanged for a token through the OAuth client_credentials grant, validate_scopes_against_key/2 in lib/hexpm_web/controllers/api/oauth_controller.ex admits a requested scope whenever the key carries the repositories permission and the scope string begins with repository:. The organization name is never resolved against the principal, and expand_repositories_scope/3 only rewrites the literal repositories scope, so an explicit repository:<name> passes through untouched. Both CDN edges authorize repository access from the token claim without querying the database, so the minted token is read access to that organization's private packages until it expires.
This issue affects hex.pm: from 2025-10-18 before 2026-08-24.
AnalysisAI
Incorrect authorization in the hex.pm OAuth client_credentials endpoint allows any API key bearing the repositories permission to mint tokens scoped to arbitrary organizations' private packages. The flaw in validate_scopes_against_key/2 accepted any scope string prefixed with repository: without resolving the organization name against the authenticated principal's actual memberships; because CDN edges evaluate repository access from token claims alone without querying the database, a minted token grants persistent read access to the targeted organization's private packages until expiration. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid hex.pm API key that carries the `repositories` permission domain; this key may belong to a personal user account or an organization account. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 8.3 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N) accurately reflects the core threat posture: network-reachable, low complexity, requiring only a valid repositories-scoped API key, with high confidentiality impact extending across organizational boundaries. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker holding a hex.pm API key with the `repositories` permission - obtained via a compromised CI/CD secret, a malicious insider, or a leaked credential - sends a POST to `/api/oauth/token` with `grant_type=client_credentials` and `scope=repository:<target_org>` naming an organization they have no membership in. The unpatched endpoint mints a valid token embedding that scope, which the attacker then presents to hex.pm's CDN edges to download the target organization's private packages without further authentication checks. |
| Remediation | The vendor-released patch is available as commit bf0fb9d208f0acfabf7a2f7467c8231659e322a8 (https://github.com/hexpm/hexpm/commit/bf0fb9d208f0acfabf7a2f7467c8231659e322a8); operators self-hosting hex.pm should update to a version incorporating this commit immediately. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Confirm your organization's use of hex.pm and identify all API keys with repository access permissions; document which systems and workflows depend on these credentials. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Insufficient session expiration in hexpm. Password reset tokens never expire, enabling persistent account takeover.
Improper input sanitization in hexpm's SharedAuthorizationView module allows unauthenticated attackers to inject malicio
An uncontrolled resource consumption vulnerability in the Hex.pm package manager allows authenticated attackers to cause
Hexpm's OAuth implementation fails to enforce read-only API key restrictions during token exchange, allowing an attacker
Path traversal in hexpm's Local Storage backend allows unauthenticated attackers to read sensitive files through relativ
OAuth token refresh in hex.pm (Elixir's package registry) fails to re-validate organizational membership when issuing ne
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today