hex.pm EUVD-2026-65120

Exploitation requires three specific conditions: (1) the attacker must have been an authenticated member of a hex.pm private organization; (2) at the time of membership revocation, the attacker must hold an OAuth refresh token whose granted_scopes contain an explicit repository:<org> or docs:<org> scope (the expanded, organization-named form - not merely the generic repositories scope); and (3) the deployment must use CDN-edge authorization that validates access from token claims without live database queries, which is the default hex.pm architecture. Exploitation is read-only - no write, publish, or administrative capability is obtainable. Access is strictly bounded by the 30-day refresh token lifetime; once that expires, further refresh attempts will fail. Users who held only the generic repositories or api scopes are not affected.

The CVSS 4.0 score of 2.3 (AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N) is well-calibrated for this vulnerability. The AT:P (attack precondition present) metric correctly captures the key constraint: exploitation requires a pre-existing OAuth token with an explicit organization scope in granted_scopes, meaning only users who previously held such a token are affected. PR:L reflects that the attacker must have been a legitimate, authenticated member. The confidentiality impact is narrow - read-only access to private package contents - with no integrity or availability exposure. No EPSS score was supplied in the input, and the vulnerability is absent from CISA KEV, providing no evidence of active exploitation. There is no public exploit code. The net real-world risk is low: the blast radius is limited to a small population (recently removed org members with scoped tokens), the access window is bounded to 30 days, and the only capability gained is private package download. No signals conflict with the supplied CVSS vector.

A former organization member who holds an OAuth refresh token with a previously granted repository:<org> scope is removed from the organization by an administrator. The attacker invokes the standard OAuth refresh grant endpoint, receiving a fresh access token that still carries the repository:<org> scope because granted_scopes is not re-validated against current membership. The attacker then uses this access token against the CDN edge to download private packages, with the cycle repeatable for the full 30-day refresh token lifetime. No proof-of-concept code has been publicly released.