CVEvulnerability

CVE-2026-97406

Published 2026-10-20 Modified 2026-10-20 Official page ↗
Status
Deferred
Published
2026-10-20
Last modified
2026-10-20
Assigner
[email protected]

Description

XERJ Console API bearer tokens can bypass the passkey‑only authentication requirement and directly invoke the API‑token creation endpoint, allowing unauthorized minting of persistent successor credentials.

References