CVE-2026-974069.1Critical
Authentication Bypass via Bearer Tokens to Unauthorized Credential Minting
Xerj · Console API
Not in CISA KEV
0.5%probability of exploitation in the next 30 days
44th percentile
050100
Higher than 44% of scored CVEs
9.1CriticalCVSS
LowMediumHighCrit.
DescriptionNVD
XERJ Console API bearer tokens can bypass the passkey‑only authentication requirement and directly invoke the API‑token creation endpoint, allowing unauthorized minting of persistent successor credentials.
Coverage1 article · 1 outlet
First in our coverage: SecurityOnline, 31 Oct.
- CERT/CC warns Xerj flaw can grant attackers lasting admin accessSecurityOnline · first in our coverage
New articles also arrive in the RSS feed.