CERT/CC warns Xerj flaw can grant attackers lasting admin access

CERT/CC has published a vulnerability note on 27 October 2026 about an authentication bypass in Xerj, tracked as CVE-2026-97406. The flaw lets attackers who already hold a bearer token mint persistent credentials without passing the required passkey verification, enabling unauthorised accounts with permanent administrative access even if the original token is revoked. The advisory states that there is no confirmed exploitation observed in the wild and no public proof-of-concept exploit code published to date.

The issue affects all current Xerj Console API versions, with the advisory listing unpatched deployments as vulnerable. The CVSS v3 score is 9.1 (Critical). The Xenrj API’s session handling code uses a generic AuthSession object for both browser sessions and API bearer tokens, failing to enforce passkey authentication for token creation. As a mitigation note, CERT/CC reports there is no official patch available at the time of writing, and vendor contact could not be established.

Administrators are advised to restrict network access to the Xerj Console API with perimeter firewalls and to monitor the project repository for forthcoming security updates. The article also notes EPSS at 0.5% (30 days).