PT-2026-81026 · Hexpm · Hex.Pm
CVSS v4.0
2.3
Low
| Vector | AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Name of the Vulnerable Software and Affected Versions
hex.pm versions 2025-10-10 through 2026-08-23
Description
An insufficient session expiration issue exists in the OAuth token refresh grant. The
expand repositories scope/3 function in lib/hexpm/permissions.ex only rewrites the literal repositories scope, allowing explicitly granted repository:<org> or docs:<org> scopes to remain unchanged. During the refresh grant process, a new token is derived from the stored granted scopes without re-verifying organization membership. Since CDN edges authorize access based on the token claim without querying the database, users removed from an organization can maintain read access to private packages for up to 30 days, which is the refresh token lifetime, instead of the intended 30-minute access token lifetime.Recommendations
Update hex.pm to a version released on or after 2026-08-24.
Exploit
Fix
Insufficient Session Expiration
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Hex.Pm