CVE-2026-97406

CVE-2026-97406

published October 20, 2026

CVSS
—
EPSS
0%
Percentile
15.7
In the wild
Unconfirmed
What it is

XERJ Console API bearer tokens can bypass the passkey‑only authentication requirement and directly invoke the API‑token creation endpoint, allowing unauthorized minting of persistent successor credentials.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00252 · 15.7th percentile
Published
2026-10-20T23:19Z
References (2)
https://kb.cert.org/vuls/id/645818 · [email protected]https://www.kb.cert.org/vuls/id/645818 · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 22 OCT 03:36Z
    EPSS moved — → 0%
    epss
  • 20 OCT 18:11Z
    Authentication Bypass via Bearer Tokens to Unauthorized Credential Minting
    cvelistv5
  • 20 OCT 18:11Z
    Authentication Bypass via Bearer Tokens to Unauthorized Credential Minting
    cvelistv5