CVE-2026-97406 - Vulnerability Details - OpenCVE

XERJ Console API bearer tokens can bypass the passkey‑only authentication requirement and directly invoke the API‑token creation endpoint, allowing unauthorized minting of persistent successor credentials.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact total

Vendors	Products
Xerj	Console Api

No data.

No data.

References

Link	Providers
https://kb.cert.org/vuls/id/645818
https://www.kb.cert.org/vuls/id/645818

History

Fri, 30 Oct 2026 21:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Thu, 29 Oct 2026 22:30:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-287

Thu, 29 Oct 2026 18:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-306 CWE-863
Metrics		cvssV3_1 `{'score': 9.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N'}`

Wed, 21 Oct 2026 17:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Xerj Xerj console Api
Vendors & Products		Xerj Xerj console Api

Tue, 20 Oct 2026 20:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-287

Tue, 20 Oct 2026 19:30:00 +0000

Type	Values Removed	Values Added
References		https://www.kb.cert.org/vuls/id/645818

Tue, 20 Oct 2026 18:30:00 +0000

Type	Values Removed	Values Added
Description		XERJ Console API bearer tokens can bypass the passkey‑only authentication requirement and directly invoke the API‑token creation endpoint, allowing unauthorized minting of persistent successor credentials.
Title		Authentication Bypass via Bearer Tokens to Unauthorized Credential Minting
References		https://kb.cert.org/vuls/id/645818

MITRE

Status: PUBLISHED

Assigner: certcc

Published: 2026-10-20T18:11:08.475Z

Updated: 2026-10-29T17:58:37.254Z

Reserved: 2026-09-24T14:49:55.504Z

Link: CVE-2026-97406

Vulnrichment

Updated: 2026-10-20T19:07:07.888Z

NVD

Status : Deferred

Published: 2026-10-20T19:19:38.900

Modified: 2026-10-29T18:17:39.830

Link: CVE-2026-97406

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-97406", "assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b", "state": "PUBLISHED", "assignerShortName": "certcc", "dateReserved": "2026-09-24T14:49:55.504Z", "datePublished": "2026-10-20T18:11:08.475Z", "dateUpdated": "2026-10-29T17:58:37.254Z"}, "containers": {"cna": {"title": "Authentication Bypass via Bearer Tokens to Unauthorized Credential Minting", "descriptions": [{"lang": "en", "value": "XERJ Console API bearer tokens can bypass the passkey\u2011only authentication requirement and directly invoke the API\u2011token creation endpoint, allowing unauthorized minting of persistent successor credentials."}], "source": {"discovery": "UNKNOWN"}, "affected": [{"vendor": "Xerj", "product": "Console API", "versions": [{"status": "affected", "version": "v1.0.0-rc.11"}]}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-306 Missing Authentication for Critical Function"}]}, {"descriptions": [{"lang": "en", "description": "CWE-863 Incorrect Authorization"}]}], "references": [{"url": "https://kb.cert.org/vuls/id/645818"}], "x_generator": {"engine": "VINCE 3.0.50", "env": "prod", "origin": "https://cveawg.mitre.org/api/cve/CVE-2026-97406"}, "providerMetadata": {"orgId": "37e5125f-f79b-445b-8fad-9564f167944b", "shortName": "certcc", "dateUpdated": "2026-10-20T18:13:22.176Z"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "https://www.kb.cert.org/vuls/id/645818"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-10-20T19:07:07.888Z"}}, {"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-306", "lang": "en", "description": "CWE-306 Missing Authentication for Critical Function"}, {"type": "CWE", "cweId": "CWE-863", "lang": "en", "description": "CWE-863 Incorrect Authorization"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-10-29T17:58:32.030214Z", "id": "CVE-2026-97406", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-29T17:58:37.254Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://www.kb.cert.org/vuls/id/645818"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-10-20T19:07:07.888Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-97406", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-29T17:58:32.030214Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-306", "description": "CWE-306 Missing Authentication for Critical Function"}, {"lang": "en", "type": "CWE", "cweId": "CWE-863", "description": "CWE-863 Incorrect Authorization"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-29T17:57:41.467Z"}}], "cna": {"title": "Authentication Bypass via Bearer Tokens to Unauthorized Credential Minting", "source": {"discovery": "UNKNOWN"}, "affected": [{"vendor": "Xerj", "product": "Console API", "versions": [{"status": "affected", "version": "v1.0.0-rc.11"}]}], "references": [{"url": "https://kb.cert.org/vuls/id/645818"}], "x_generator": {"env": "prod", "engine": "VINCE 3.0.50", "origin": "https://cveawg.mitre.org/api/cve/CVE-2026-97406"}, "descriptions": [{"lang": "en", "value": "XERJ Console API bearer tokens can bypass the passkey\u2011only authentication requirement and directly invoke the API\u2011token creation endpoint, allowing unauthorized minting of persistent successor credentials."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-306 Missing Authentication for Critical Function"}]}, {"descriptions": [{"lang": "en", "description": "CWE-863 Incorrect Authorization"}]}], "providerMetadata": {"orgId": "37e5125f-f79b-445b-8fad-9564f167944b", "shortName": "certcc", "dateUpdated": "2026-10-20T18:13:22.176Z"}}}, "cveMetadata": {"cveId": "CVE-2026-97406", "state": "PUBLISHED", "dateUpdated": "2026-10-29T17:58:37.254Z", "dateReserved": "2026-09-24T14:49:55.504Z", "assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b", "datePublished": "2026-10-20T18:11:08.475Z", "assignerShortName": "certcc"}, "dataVersion": "5.2"}