CVE-2026-86698

Insufficient Session Expiration vulnerability in OAuth token issuance in hexpm hexpm allows a user whose organization membership or session has ended to keep reading the organization's private packages and their documentation tarballs via a retained refresh token. generate_refresh_token/4 in lib/hexpm/oauth/jwt.ex signs the refresh token with the same iss, aud and scope claims as the access token, so it carries the same repository:<org> scopes. The CDN service that serves private repositories verifies the signature and time claims and then authorizes from the scope claim, with no database lookup and no way to tell the two token kinds apart. Removing a member or revoking a session therefore takes effect at the CDN only when the 30 day refresh token expires, instead of after the 30 minute access token lifetime. Access is read-only and limited to organizations the account belonged to when the token was granted. This issue affects hex.pm: from 2025-10-10 before 2026-09-22.

• CWE-613

• https://cna.erlef.org/cves/CVE-2026-86698.html
• https://github.com/hexpm/hexpm/commit/650faa03af511e74c1b3b49ec12d35666b6984c4
• https://github.com/hexpm/hexpm/commit/db58cf3a86c7639708ef52ff86de0b4f938e6360
• https://github.com/hexpm/hexpm/security/advisories/GHSA-vmw7-7g2w-gw2f
• https://osv.dev/vulnerability/EEF-CVE-2026-86698
• https://github.com/hexpm/hexpm/security/advisories/GHSA-vmw7-7g2w-gw2f

Published

Sep 22, 2026

Last Modified

Sep 22, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-8668A static credential embedded in Chef 360 prior to v1.7.0 per…2.3
• CVE-2026-86681ZohoCorp ManageEngine Applications Manager versions 182200 a…7.6
• CVE-2026-86683ZohoCorp ManageEngine Applications Manager versions 182000 a…8.1
• CVE-2026-86688Session Fixation vulnerability in team-alembic ash_authentic…7.4
• CVE-2026-86689Bransys ELD is shipped with hardcoded MQTT credentials, whic…5.9
• CVE-2026-8669Imager versions through 1.030 for Perl allow a heap out of b…6.5
• CVE-2026-8670Insufficient session expiration vulnerability in syslink sof…9.6
• CVE-2026-86701Android application "ManabiPocket for Parents" contains an i…1.8
• CVE-2026-86707The Private Feed Key WordPress plugin through 0.1 does not v…9.8
• CVE-2026-86708ZohoCorp ManageEngine Applications Manager versions 182200 a…10
• CVE-2026-86709The Pressengine WordPress plugin through 1.0 does not stop i…9.8
• CVE-2026-8671Insertion of sensitive information into log file vulnerabili…7.5