Console Api
Monthly
Bearer tokens accepted by the XERJ Console API v1.0.0-rc.11 can reach the API-token creation endpoint that is intended to require passkey-only authentication, allowing anyone holding such a token to mint persistent successor API credentials that survive remediation of the original token. The independent assessment scores this 9.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), while the CVE record carries a conflicting PR:N vector - the privilege requirement should be confirmed with the vendor, since the mechanism as described turns on possession of a valid bearer token rather than anonymous access. Exposure is confined to a single pre-release build of the Console API, EPSS is 0.25% (16th percentile), there is no CISA KEV listing, and no public exploit was identified at time of analysis, although the vuln.today decision label is act_now and the report originated with CERT/CC.
Bearer tokens accepted by the XERJ Console API v1.0.0-rc.11 can reach the API-token creation endpoint that is intended to require passkey-only authentication, allowing anyone holding such a token to mint persistent successor API credentials that survive remediation of the original token. The independent assessment scores this 9.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), while the CVE record carries a conflicting PR:N vector - the privilege requirement should be confirmed with the vendor, since the mechanism as described turns on possession of a valid bearer token rather than anonymous access. Exposure is confined to a single pre-release build of the Console API, EPSS is 0.25% (16th percentile), there is no CISA KEV listing, and no public exploit was identified at time of analysis, although the vuln.today decision label is act_now and the report originated with CERT/CC.