CVE-2026-1842

HyperCloud versions 2.3.5 through 2.6.8 improperly allowed refresh tokens to be used directly for resource access and failed to invalidate previously issued access tokens when a refresh token was used. Because refresh tokens have a significantly longer lifetime (default one year), an authenticated client could use a refresh token in place of an access token to maintain long-term access without token rotation. Additionally, old access tokens remained valid after refresh, enabling concurrent or extended use beyond intended session boundaries. This vulnerability could allow prolonged unauthorized access if a token is disclosed.

• CWE-613

• https://advisories.softiron.cloud/

Published

Feb 20, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-18406The SureForms – Contact Form Builder, AI Forms, Payment Form…7.2
• CVE-2026-18408Untrusted data inclusion in pg_dump in PostgreSQL allows a m…8.8
• CVE-2026-18409The WPForms Pro plugin for WordPress is vulnerable to Stored…7.2
• CVE-2026-1841The PixelYourSite – Your smart PIXEL (TAG) & API Manager plu…7.2
• CVE-2026-18411The KARR Security System and SWDS dealer-installed automotiv…8.1
• CVE-2026-18412OpenCart extensions are uploaded as zip files with .ocmod.zi…9.1
• CVE-2026-18420Improper input validation in the Time Series Visual Builder …8.8
• CVE-2026-18421Concrete CMS 9 through 9.5.2 does not perform an authorizati…2.1
• CVE-2026-18422Concrete CMS before 9.5.3 did not enforce a destination-side…6.5
• CVE-2026-18423Concrete CMS 9.0.0 through 9.5.2 is vulnerable to Insecure d…7.1
• CVE-2026-18424Concrete CMS 9.0.0 to 9.5.2 is vulnerable to Server-Side Req…7.1
• CVE-2026-18425Concrete CMS 9 before 9.5.3 authorized the dashboard sitemap…2.7