Insufficient Session Expiration in HexPM Affects User Account Security

CVE-2026-21622

What is CVE-2026-21622?

In HexPM's password reset mechanism, the tokens generated for resetting passwords do not expire, creating a significant security risk. Attackers can exploit this vulnerability if they gain access to historical emails that contained password reset tokens. Since these tokens are valid indefinitely, they can be used to reset a victim's password—even without current access to the victim's email account. The absence of time-based expiration for the password reset links exposes users to potential account takeovers, particularly if their past correspondence is compromised. Addressing this issue is crucial for maintaining the integrity of user accounts.

References