VDB
CVE-2026-97406
CVE-2026-97406
PUBLISHED
Reported by certcc · Published October 20, 2026
XERJ Console API bearer tokens can bypass the passkey‑only authentication requirement and directly invoke the API‑token creation endpoint, allowing unauthorized minting of persistent successor credentials.
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Xerj | Console API | v1.0.0-rc.11 |
| Xerj | Console API | v1.0.0-rc.11 |
Timeline
- Oct 20, 2026 Coalition ESS Score
- Oct 20, 2026 CVE Published
- Oct 20, 2026 CVE Updated
- Oct 21, 2026 EPSS Score
- Oct 21, 2026 Security Advisory
- Oct 25, 2026 EPSS Score