PT-2026-141568
CVE-2026-119446
·
Published
2026-11-10
·
Updated
2026-11-10
Description by
CVSS 4.0
9.4
CriticalMetricsAV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Name of the Vulnerable Software and Affected Versions
nerves hub versions 2.5.0 through 2.5.2
Description
A session fixation issue exists in the CLI login flow of nerves hub web. An unauthenticated attacker can obtain an API token for another user's account by persuading them to open a crafted login link and click a confirmation button. The process begins when a request is made to the 'POST /api/auth/cli session' endpoint, which returns a polling token and a confirmation URL. If a signed-in user opens this URL and confirms, the
verify cli session token/2 function creates an API token for that user. This token is then returned to the attacker via the 'GET /api/auth/cli session/' endpoint. The confirmation code provided during this process is only displayed and not verified, failing to ensure that the person confirming the session is the same person who initiated the login.Recommendations
Update to version 2.5.3.
Found an issue in the description? Have something to add? Feel free to write us 👾