CVE-2026-86698
LowCVSS 2.3Exploitation Probability (EPSS)
Low risk37th percentile - higher than 37% of all known CVEs
Summary
hexpm (hex.pm) has a vulnerability of insufficient session expiration in OAuth tokens. A user whose organization membership or session has ended can still read the organization's private packages and documentation via a retained refresh token. Access is read-only and limited to organizations the account belonged to when the token was granted.
Risk Assessment
The risk is unauthorized access to private packages after membership ends, potentially compromising data confidentiality.
Recommendation
Revoke refresh tokens immediately after session or membership termination and consider shorter token lifetimes.
Other vulnerabilities in hexpm
See all- CVE-2026-75554Low
hexpm (hex.pm) has a vulnerability due to insufficient session expiration in the OAuth token refresh grant. A user removed from an organization can still read private packages because permission scopes are not properly updated. Affects hex.pm from 2025-10-10 before 2026-08-24.
- CVE-2026-75542High
An incorrect authorization vulnerability in the OAuth token endpoint in hexpm allows an API key with the repositories permission to read another organization's private packages. During key exchange for a token, scope validation does not resolve the organization name against the principal, and repository:<name> scope passes through unchanged. The token grants read access to that organization's private packages until expiration.
- CVE-2026-21618Medium
hexpm (hex.pm) has a Cross-Site Scripting (XSS) vulnerability in the Elixir.HexpmWeb.SharedAuthorizationView module. The render_grouped_scopes/3 function does not sanitize input, allowing script injection.
Original NVD description (English source)
Insufficient Session Expiration vulnerability in OAuth token issuance in hexpm hexpm allows a user whose organization membership or session has ended to keep reading the organization's private packages and their documentation tarballs via a retained refresh token. generate_refresh_token/4 in lib/hexpm/oauth/jwt.ex signs the refresh token with the same iss, aud and scope claims as the access token, so it carries the same repository:<org> scopes. The CDN service that serves private repositories verifies the signature and time claims and then authorizes from the scope claim, with no database lookup and no way to tell the two token kinds apart. Removing a member or revoking a session therefore takes effect at the CDN only when the 30 day refresh token expires, instead of after the 30 minute access token lifetime. Access is read-only and limited to organizations the account belonged to when the token was granted. This issue affects hex.pm: from 2025-10-10 before 2026-09-22.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS