Session Fixation Vulnerability in NervesHub CLI Login Flow by Nerves Hub

CVE-2026-119446

What is CVE-2026-119446?

A session fixation vulnerability in the CLI login flow of NervesHub allows unauthenticated attackers to manipulate the login process. An attacker can create a crafted login link that, when clicked by an unsuspecting user, leads to the generation of an API token for the user’s account. This occurs through a process where the user is prompted to confirm their login via a confirmation URL that is not securely verified. The attacker must entice the user to open this link, as the confirmation code displayed is never validated against a prior request. Thus, sensitive access can be obtained without proper authentication, compromising user accounts and data integrity.

References