CVE-2026-97406

Published: Ott 20, 2026 Last Modified: Ott 20, 2026
ExploitDB:
Other exploit source:
Google Dorks:

Description

AI Translation Available

XERJ Console API bearer tokens can bypass the passkey‑only authentication requirement and directly invoke the API‑token creation endpoint, allowing unauthorized minting of persistent successor credentials.

https://www.kb.cert.org/vuls/id/645818
https://www.kb.cert.org/vuls/id/645818
https://kb.cert.org/vuls/id/645818
https://kb.cert.org/vuls/id/645818