Token Mismanagement in HyperCloud by SoftIron

CVE-2026-1842

What is CVE-2026-1842?

The vulnerability in HyperCloud versions 2.3.5 through 2.6.8 arises from improper handling of refresh tokens, which were allowed to be used directly for resource access. This oversight prevented the invalidation of previously issued access tokens when a refresh token was utilized, enabling an authenticated client to substitute a refresh token for an access token. The significantly longer lifespan of refresh tokens (defaulting to one year) means that if a refresh token is compromised, it can grant prolonged unauthorized access without necessitating token rotation. Furthermore, the continued validity of old access tokens after a refresh can lead to unintentional session overlap or extended access beyond the intended scope. Organizations should assess their security measures and implement proper token validation and expiration processes to mitigate potential risks.

References