cveboard RSS feed

CVE-2026-97406

cve.nowCritical

Xerj Console API

  • Xerj Console API
  • Critical
  • CVSS 9.1
  • EPSS 0.22%
  • No fixed version listed

Summary

XERJ Console API bearer tokens can bypass the passkey‑only authentication requirement and directly invoke the API‑token creation endpoint, allowing unauthorized minting of persistent successor credentials.

From the CVE record.

What to do

No fixed version listed

Plain text

Affected products

ProductAffectedFixed in
Xerj Console APIv1.0.0-rc.11None listed

Scores and signals

Exploitation
No known exploitation
Severity
Critical, CVSS 9.1 (v3.1, scored by CISA-ADP)
EPSS
0.22% chance of exploitation in the next 30 days (EPSS from FIRST, as of Oct 29, 2026)
CISA's SSVC decision points
Exploitation: none. Automatable: yes. Technical impact: total. As of Oct 29, 2026.
Weakness
CWE-306: Missing Authentication for Critical Function; CWE-863: Incorrect Authorization
Vendor
Xerj, Console API

Timeline

  1. First listed as critical by cve.now. Affected and fixed versions come from the CVE record, once one is published.

Sources

All live incidents