Unrated severityNVD Advisory· Published Oct 20, 2026· Updated Oct 20, 2026
CVE-2026-97406
CVE-2026-97406
Description
XERJ Console API bearer tokens can bypass the passkey‑only authentication requirement and directly invoke the API‑token creation endpoint, allowing unauthorized minting of persistent successor credentials.
Affected products
1Patches
Vulnerability mechanics
References
2News mentions
0No linked articles in our index yet.