CVE-2026-21622

Insufficient Session Expiration vulnerability in hexpm hexpm/hexpm ('Elixir.Hexpm.Accounts.PasswordReset' module) allows Account Takeover. Password reset tokens generated via the "Reset your password" flow do not expire. When a user requests a password reset, Hex sends an email containing a reset link with a token. This token remains valid indefinitely until used. There is no time-based expiration enforced. If a user's historical emails are exposed through a data breach (e.g., a leaked mailbox archive), any unused password reset email contained in that dataset could be used by an attacker to reset the victim's password. The attacker does not need current access to the victim's email account, only access to a previously leaked copy of the reset email. This vulnerability is associated with program files lib/hexpm/accounts/password_reset.ex and program routines 'Elixir.Hexpm.Accounts.PasswordReset':can_reset?/3. This issue affects hexpm: from 617e44c71f1dd9043870205f371d375c5c4d886d before bb0e42091995945deef10556f58d046a52eb7884.

• CWE-613

• https://cna.erlef.org/cves/CVE-2026-21622.html
• https://github.com/hexpm/hexpm/commit/bb0e42091995945deef10556f58d046a52eb7884Patch
• https://github.com/hexpm/hexpm/security/advisories/GHSA-6r94-pvwf-mxqmPatch, Vendor Advisory
• https://osv.dev/vulnerability/EEF-CVE-2026-21622

Published

Mar 5, 2026

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-2161A vulnerability was found in itsourcecode Directory Manageme…9.8
• CVE-2026-21618Improper Neutralization of Input During Web Page Generation …6.1
• CVE-2026-21619Uncontrolled Resource Consumption, Deserialization of Untrus…7.5
• CVE-2026-2162A vulnerability was determined in itsourcecode News Portal P…7.2
• CVE-2026-21620Relative Path Traversal, Improper Isolation or Compartmental…2.3
• CVE-2026-21621Incorrect Authorization vulnerability in hexpm hexpm/hexpm (…5.3
• CVE-2026-21623Lack of input filterung leads to a persistent XSS vulnerabil…5.4
• CVE-2026-21624Lack of input filterung leads to a persistent XSS vulnerabil…5.4
• CVE-2026-21625User provided uploads to the Easy Discuss component for Joom…8.8
• CVE-2026-21626Access control settings for forum post custom fields are not…7.5
• CVE-2026-21627The vulnerability was rooted in how the Tassos Framework plu…9.5
• CVE-2026-21628A improperly secured file management feature allows uploads …9.8