Xerj Console API Authentication Bypass Leads to Unauthorized Credential Minting

Classification: Severe, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: None, CVEs: CVE-2026-97406, Summary: An authentication bypass vulnerability in the Xerj Console API allows sessions to bypass passkey-backed requirements during token issuance. By exploiting this flaw, an attacker with an existing valid token can create independent, persistent successor credentials directly through the console API. This allows the attacker to maintain access and potentially escalate…

Číst originál na NCSC-FI →

CZ · EN/orig

Xerj FI

tg: zranitelnost tp: identita

CVE v události 1

CVE	hodnocení	KEV	EPSS
CVE-2026-97406	9.1 3.1 · CISA-ADP	–	0.01

Hodnocení z katalogů, všechna, se stupnicí CVSS a vydavatelem. Rozpad vektoru je na stránce CVE.