Live › vulnerability › CVE-2026-97406
Go to dashboardXERJ Console API bearer tokens can skip the passkey-only login requirement and call the API-token creation endpoint directly. An attacker holding one token can mint persistent successor credentials that outlive the original.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
XERJ Console API bearer tokens can bypass the passkey‑only authentication requirement and directly invoke the API‑token creation endpoint, allowing unauthorized minting of persistent successor credentials.
This page as .md · .json · in your agent: get_signal("CVE-2026-97406")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.