VulnSocial

CVE-2026-97406

LOWCVSS 9.1 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

XERJ Console API bearer tokens can bypass the passkey‑only authentication requirement and directly invoke the API‑token creation endpoint, allowing unauthorized minting of persistent successor credentials.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-306CWE-863

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

  • 1 mentions across 1 observed day

What's happening

  • 1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d
00111Mentions · 2026-10-29: 110-29
Referenced assets1 URL
By indicator
Full discourse1 post
  • cve.now@cvedotnow

    🔴 Xerj Console API: auth bypass in API tokens enables credential minting (CVE-2026-97406) Attackers holding a bearer token can skip passkey login and create persistent API credentials. Disclosed Oct 20 No patch listed yet https://cve.now/CVE-2026-97406

    00010559
    8.2K followersView on X

Explore more

Back to dashboard