Improper Session Invalidation in Nerves Hub by Nerves Hub

CVE-2026-120997

What is CVE-2026-120997?

The Nerves Hub platform suffers from an improper session invalidation flaw that allows users who have been removed or demoted to retain access to functionality associated with their previous roles. This occurs due to the dashboard and other communication channels only verifying user roles during initial page load or connection. Consequently, open sessions remain active, enabling unauthorized actions until the page is refreshed or the user disconnects. Additionally, tokens utilized for accessing user consoles do not expire immediately upon logout, resulting in extended access for any parties who obtain valid tokens before user role changes take effect.

References