hex.pm CVE-2026-86698

Exploitation requires that the attacker already possess a valid OAuth refresh token issued by hex.pm while they were a member of the target private organization, AND that their organization membership or session has since been terminated. The flaw is reachable because private-repository requests are served by a CDN that verifies only the JWT signature and time claims and authorizes from the embedded repository:<org> scope, performing no database membership lookup and unable to distinguish refresh tokens from access tokens. Limiting factors: access is read-only, confined strictly to organizations the account belonged to at token-grant time, and self-expires when the 30-day refresh token lapses; the actor must have been an authenticated member (not an external unauthenticated party), so this is fundamentally an offboarding/revocation-window exposure rather than open remote compromise.

This is a genuinely low-priority issue and the signals are internally consistent. The vendor CVSS 4.0 base score is 2.3 (AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N): network-reachable but requiring a specific attack precondition (AT:P), authenticated (PR:L), and limited to low confidentiality impact with no integrity or availability effect. No EPSS score was provided, the CVE is not in CISA KEV, and no public proof-of-concept was supplied - so there is no public exploit identified at time of analysis. The impact is narrow by design: read-only access, scoped only to organizations the account already belonged to when the token was granted, and self-limiting to the 30-day refresh-token lifetime. There is no privilege escalation, no write, and no path to new data the actor did not previously have visibility into as a member. The realistic risk is an insider/offboarding-window exposure (a removed member or ended session retaining access for up to 30 days) rather than mass or opportunistic exploitation. No conflicting signals: CVSS network vector aligns with the CDN-token architecture described, and the low score matches the read-only, precondition-gated nature. Note the AT:P (4.0) precondition - possession of a still-valid refresh token issued during membership - is a real limiter that raw 'network vector' framing could understate.

A developer who was a member of a private hex.pm organization is removed from that organization (or their session is revoked), but they retain the OAuth refresh token issued while they were a member. Because the CDN that serves private repositories authorizes requests purely from the signed scope claim without any database lookup, the former member continues pulling the organization's private packages and documentation tarballs until the 30-day refresh token expires. No public exploit code is required or identified; the attacker simply keeps using a token they already legitimately hold.