Insufficient Session Expiration in Token Issuance for Hex.pm by Hexpm

CVE-2026-86698

What is CVE-2026-86698?

The vulnerability allows users whose organization membership or session has ended to retain access to private packages and documentation tarballs through a retained refresh token. The refresh token generation process within Hex.pm signs these tokens with the same claims as the access tokens, leading to a critical oversight. Consequently, users can maintain read-only access to organizational resources until their refresh token expires, which could take up to 30 days, despite their membership status having changed. This flaw highlights serious implications for organizational data privacy and security.

References