EUVD-2026-65120Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Requires authenticated prior membership (PR:L) and a pre-existing org-scoped token (AC:H); read-only confidentiality impact with no integrity or availability exposure.
Primary rating from Vendor (EEF).
CVSS VectorVendor: EEF
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
Insufficient Session Expiration vulnerability in the OAuth token refresh grant in hexpm hexpm allows a user removed from an organization to keep reading its private packages.
expand_repositories_scope/3 in lib/hexpm/permissions.ex only rewrites the literal repositories scope, so an explicitly granted repository:<org> or docs:<org> scope passes through it untouched. The refresh grant re-derives a new token from the stored granted_scopes, which holds that expanded form, so every refresh reproduces the organization scope without revisiting membership. Because both CDN edges authorize repository access from the token claim without querying the database, an account removed from an organization retains read access for as long as it keeps refreshing, bounded by the 30 day refresh token lifetime rather than the 30 minute access token lifetime.
This issue affects hex.pm: from 2025-10-10 before 2026-08-24.
AnalysisAI
OAuth token refresh in hex.pm (Elixir's package registry) fails to re-validate organizational membership when issuing new access tokens, allowing users removed from a private organization to retain read access to its packages. Affected are hex.pm deployments from 2025-10-10 through 2026-08-24. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires three specific conditions: (1) the attacker must have been an authenticated member of a hex.pm private organization; (2) at the time of membership revocation, the attacker must hold an OAuth refresh token whose granted_scopes contain an explicit repository:<org> or docs:<org> scope (the expanded, organization-named form - not merely the generic repositories scope); and (3) the deployment must use CDN-edge authorization that validates access from token claims without live database queries, which is the default hex.pm architecture. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 2.3 (AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N) is well-calibrated for this vulnerability. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A former organization member who holds an OAuth refresh token with a previously granted repository:<org> scope is removed from the organization by an administrator. The attacker invokes the standard OAuth refresh grant endpoint, receiving a fresh access token that still carries the repository:<org> scope because granted_scopes is not re-validated against current membership. … |
| Remediation | The upstream fix is available in commit 50cffd206490c49c92d7b63c8505949682abedb0 (https://github.com/hexpm/hexpm/commit/50cffd206490c49c92d7b63c8505949682abedb0), which introduces Permissions.reject_unaffiliated_scopes/2 to filter out organization scopes for users no longer affiliated with that organization during every token refresh. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Insufficient session expiration in hexpm. Password reset tokens never expire, enabling persistent account takeover.
Improper input sanitization in hexpm's SharedAuthorizationView module allows unauthenticated attackers to inject malicio
Incorrect authorization in the hex.pm OAuth `client_credentials` endpoint allows any API key bearing the `repositories`
An uncontrolled resource consumption vulnerability in the Hex.pm package manager allows authenticated attackers to cause
Hexpm's OAuth implementation fails to enforce read-only API key restrictions during token exchange, allowing an attacker
Path traversal in hexpm's Local Storage backend allows unauthenticated attackers to read sensitive files through relativ
Same weakness CWE-613 – Insufficient Session Expiration
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today