API Token Vulnerability in XERJ Console by Vendor

CVE-2026-97406

What is CVE-2026-97406?

An authentication bypass vulnerability exists in the XERJ Console API, where bearer tokens can circumvent the passkey-only requirement. This allows malicious actors to directly access the API-token creation endpoint, enabling unauthorized generation of persistent successor credentials. As a result, attackers can exploit this flaw to gain unauthorized access to sensitive resources within the application.

References