Improper Authorization in Hexpm API Leading to Privilege Escalation

CVE-2026-21621

What is CVE-2026-21621?

The Hexpm API has a vulnerability in the OAuthController that improperly handles read-only API keys. This flaw allows an attacker who manages to obtain such a key and a valid 2FA code to escalate their access level. When exchanging a read-only API key using the OAuth client_credentials grant, the intended resource scope is overlooked, allowing the JWT to be assigned a broad API access scope instead of the restricted read scope. As a result, attackers can generate an unrestricted API key for write operations, which could lead to malicious activities like publishing or modifying packages without detection.

References