EUVD-2026-105251
GHSA-vjpr-qxjc-7crv
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessPresent bearer token to Console API
-
ExploitBypass passkey-only auth check
-
ExecutionInvoke API-token creation endpoint
-
ImpactMint persistent successor credentials
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The attacker must be able to present a Console API bearer token to the API-token creation endpoint; the defect is that such bearer tokens satisfy access to an endpoint that is supposed to require passkey-only authentication, letting the caller create new persistent API tokens. The practical limiting factor is possession of a valid bearer token - the description frames this as a bearer-token path bypassing the passkey gate, not as fully anonymous access, which is why the NVD PR:N should be verified with the vendor. Scope is confined to Console API v1.0.0-rc.11, a single pre-release build, which sharply limits the set of exposed deployments. |
| Impact | Signals conflict, and the split is the whole story. Severity signals run hot: CVSS 9.1 with AV:N/AC:L/PR:N/UI:N and dual high confidentiality/integrity impact, CWE-306 (missing authentication for a critical function), and a vuln.today 'act_now' priority label argue for immediate action. Exposure signals run cold: EPSS is 0.25% (16th percentile), the vulnerability is NOT on the CISA KEV list, and no public exploit or PoC reference is present in the input - exploitation status is 'no public exploit identified at time of analysis.' The reconciling factor is prevalence: XERJ Console API is an obscure product and the only affected build listed is a pre-release candidate (v1.0.0-rc.11), so a low EPSS most likely reflects a tiny installed base rather than low exploitability of the flaw itself. One metric needs verification: the NVD vector asserts PR:N (unauthenticated), but the description states that 'bearer tokens can bypass the passkey-only authentication requirement,' which implies the attacker must already present a valid bearer token - i.e. some credential (PR:L) rather than none. Net: for any organization actually running Console API rc.11 this is a genuine act_now priority (trivial auth bypass yielding persistent credential minting); for everyone else the real-world risk is bounded by near-zero deployment, not by the technical severity. |
| Exploit ScenarioDerived | An attacker holding a lower-privilege Console API bearer token sends it directly to the API-token creation endpoint, which should be reachable only after passkey authentication. The gate fails to enforce passkey-only auth for bearer-token callers, so the request succeeds and the attacker mints new persistent API tokens that survive beyond the original session. No public exploit code or PoC reference is present in the input. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 29, 2026
Bearer tokens accepted by the XERJ Console API v1.0.0-rc.11 can reach the API-token creation endpoint that is intended to require passkey-only authentication, allowing anyone holding such a token to mint persistent successor API credentials that survive remediation of the original token. The independent assessment scores this 9.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), while the CVE record carries a conflicting PR:N vector - the privilege requirement should be confirmed with the vendor, since the mechanism as described turns on possession of a valid bearer token rather than anonymous access. Exposure is confined to a single pre-release build of the Console API, EPSS is 0.25% (16th percentile), there is no CISA KEV listing, and no public exploit was identified at time of analysis, although the vuln.today decision label is act_now and the report originated with CERT/CC.
RemediationAI
No vendor-released patch or fixed version is identified at time of analysis, and no workaround is documented in the supplied sources; the CERT/CC vulnerability note VU#645818 (https://kb.cert.org/vuls/id/645818) is the coordination point to monitor for vendor guidance and a patched Console API build, and the NVD record (https://nvd.nist.gov/vuln/detail/CVE-2026-97406) should be watched for a corrected CVSS vector, since the published PR:N conflicts with the assessed PR:L and changes the exposure calculus considerably. Because the assessed precondition is possession of a valid Console API bearer token, the concrete exposure-reduction step supported by the evidence is to establish which deployments run v1.0.0-rc.11 and which principals currently hold bearer tokens against those instances, and to treat any token minted through the creation endpoint as suspect until the endpoint's passkey-only enforcement is confirmed by the vendor - rotation of existing tokens alone would not remove successor credentials already created through the bypass. Deployments that cannot confirm the endpoint's authentication behaviour should be treated as unpatched, and any decision to keep rc.11 in service should be recorded against the act_now priority assigned by vuln.today despite the low 0.25% EPSS score.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is CWE-306, Missing Authentication for Critical Function: the Console API's API-token creation endpoint is designed to be gated behind passkey-only authentication, but bearer tokens are also treated as sufficient proof for that endpoint, so the passkey gate can be stepped around entirely by a caller who already holds a bearer token. The result is not direct data theft but credential persistence - each successful call mints a new long-lived API token that the attacker controls, extending access beyond the lifetime of the original bearer credential. The affected code is the XERJ Console API at v1.0.0-rc.11, matched by CPE cpe:2.3:a:xerj:console_api:*:*:*:*:*:*:*:*; the source data does not describe the token format, signing scheme, endpoint path, or whether the bearer check is a middleware ordering issue or an explicit alternative authentication path. The CVE record's CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N conflicts with the independent assessment's PR:L rating; the difference matters because PR:N implies any network attacker can mint tokens, whereas PR:L confines the issue to parties who already hold a bearer token. Neither the CERT/CC note (VU#645818) nor the NVD entry, as supplied, explains the triggering sequence beyond the endpoint-level description.
Know when Console Api gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Network-reachable endpoint with low complexity; PR:L rather than NVD's PR:N because the description requires presenting a bearer token; minting persistent credentials yields C:H/I:H, A:N.
Primary rating from Vendor (certcc).
CVSS VectorVendor: certcc
Lifecycle Timeline
3DescriptionCVE.org
XERJ Console API bearer tokens can bypass the passkey‑only authentication requirement and directly invoke the API‑token creation endpoint, allowing unauthorized minting of persistent successor credentials.
Executive ViewAI
The XERJ Console API v1.0.0-rc.11 contains a critical privilege escalation flaw allowing any holder of a valid bearer token to mint persistent API credentials, bypassing intended passkey-only controls. This enables unauthorized access that survives token remediation, affecting organizations using this pre-release build. Leadership should prioritize immediate containment and upgrade to a fixed version once available.
No vendor-released patch identified at time of analysis. Interim mitigations: strictly limit API access to authorized networks, enforce strong authentication (e.g., mTLS) for all API consumers, monitor and alert on API token creation events, and rotate bearer tokens frequently.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB