hexpm 2026-08-24 OAuth Token Issuance lib/hexpm/oauth/jwt.ex generate_refresh_token session expiration

Summaryinfo

A vulnerability marked as problematic has been reported in hexpm. Affected is the function generate_refresh_token of the file lib/hexpm/oauth/jwt.ex of the component OAuth Token Issuance. This manipulation causes session expiration. This vulnerability is tracked as CVE-2026-86698. The attack is possible to be carried out remotely. No exploit exists. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability was found in hexpm. It has been declared as problematic. Affected by this vulnerability is the function generate_refresh_token of the file lib/hexpm/oauth/jwt.ex of the component OAuth Token Issuance. The manipulation with an unknown input leads to a session expiration vulnerability. The CWE definition for the vulnerability is CWE-613. According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization." As an impact it is known to affect confidentiality. The summary by CVE is:

Insufficient Session Expiration vulnerability in OAuth token issuance in hexpm hexpm allows a user whose organization membership or session has ended to keep reading the organization's private packages and their documentation tarballs via a retained refresh token. generate_refresh_token/4 in lib/hexpm/oauth/jwt.ex signs the refresh token with the same iss, aud and scope claims as the access token, so it carries the same repository:<org> scopes. The CDN service that serves private repositories verifies the signature and time claims and then authorizes from the scope claim, with no database lookup and no way to tell the two token kinds apart. Removing a member or revoking a session therefore takes effect at the CDN only when the 30 day refresh token expires, instead of after the 30 minute access token lifetime. Access is read-only and limited to organizations the account belonged to when the token was granted. This issue affects hex.pm: from 2025-10-10 before 2026-09-22.

The advisory is shared at github.com. This vulnerability is known as CVE-2026-86698 since 09/17/2026. The exploitation appears to be easy. The attack can be launched remotely. Technical details are known, but no exploit is available.

Upgrading to version 2026-09-22 eliminates this vulnerability.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Name

• hexpm

Version

• 2026-08-24

Website

• Product: https://github.com/hexpm/hexpm/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion