Refresh tokens accepted as private repository credentials at the CDN (CVE-2026-86698)

What is affected, what to do

Insufficient Session Expiration vulnerability in OAuth token issuance in hexpm hexpm allows a user whose organization membership or session has ended to keep reading the organization's private packages and their documentation tarballs via a retained refresh token. generate_refresh_token/4 in lib/hexpm/oauth/jwt.ex signs the refresh token with the same iss, aud and scope claims as the access token, so it carries the same repository:<org> scopes. The CDN service that serves private repositories verifies the signature and time claims and then authorizes from the scope claim, with no database lookup and no way to tell the two token kinds apart.

Update Hexpm to version 2026-09-22.

Affected

• Hexpm lt 2025-10-10..2026-09-22

Fixed in

• Hexpm 2026-09-22

Not sure whether and how you are affected? Ask a question about this vulnerability

Metrics

Detection rules

No NEOSEC detection rule is available for this vulnerability yet.

Classification under NIS2 and CRA

Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

NIS2

NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

Read in glossary

Handle the vulnerability in regular vulnerability handling under Art. 21(2)(e) NIS2.

CRA

The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

Read in glossary

From 11.12.2027, Annex I Part II CRA requires manufacturers of affected products with digital elements to handle vulnerabilities without delay and provide security updates.

ISO/IEC 27001

ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

Read in glossary

Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

Description

Insufficient Session Expiration vulnerability in OAuth token issuance in hexpm hexpm allows a user whose organization membership or session has ended to keep reading the organization's private packages and their documentation tarballs via a retained refresh token. generate_refresh_token/4 in lib/hexpm/oauth/jwt.ex signs the refresh token with the same iss, aud and scope claims as the access token, so it carries the same repository:<org> scopes. The CDN service that serves private repositories verifies the signature and time claims and then authorizes from the scope claim, with no database lookup and no way to tell the two token kinds apart. Removing a member or revoking a session therefore takes effect at the CDN only when the 30 day refresh token expires, instead of after the 30 minute access token lifetime. Access is read-only and limited to organizations the account belonged to when the token was granted. This issue affects hex.pm: from 2025-10-10 before 2026-09-22.

Source: NVD (NIST), cvelistv5, OSV (Open Source Vulnerabilities)

Vendors and products

• Hexpm Hexpm

Weakness classes (CWE)

• CWE-613Insufficient Session Expiration

  Base

  According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."

  Entry at MITRE CWE-613

References & sources

• github.comRefresh tokens are accepted as private repository credentials at the CDNVendor advisory, related
• cna.erlef.orgEEF CNA record for CVE-2026-86698related
• OSV (Open Source Vulnerabilities)OSV record EEF-CVE-2026-86698related
• github.comIntroducing commit 650faa0 in hexpm/hexpmrelated
• github.comFix commit db58cf3 in hexpm/hexpmPatch

Changes to this CVE

Who changed this CVE and when: NVD (analysis, affected products, CVSS), the CVE publisher (CNA) and additional providers such as CISA (ADP).

1. 22.09.2026Record modifiedCISA ADP

   CISA assessment (SSVC): exploitation: proof of concept, automatable: no

   New references:

   • https://github.com/hexpm/hexpm/security/advisories/GHSA-vmw7-7g2w-gw2f
   Show 2 original changes

   Individual changes of this event as published by NVD

   Type	Action	Before	After
   Reference	added	—	https://github.com/hexpm/hexpm/security/advisories/GHSA-vmw7-7g2w-gw2f
   SSVC assessment	added	—	{"id":"CVE-2026-86698","role":"CISA Coordinator","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"version":"2.0.3","timestamp":"2026-09-22T18:05:56.100145Z"}

   Source identifier: 134c704f-9b21-4f2e-91b3-4a467353bcc0

2. 22.09.2026ReceivedEEF

   CVSS V4.0: AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N

   Weakness type: CWE-613

   Description added or changed

   New references:

   • https://cna.erlef.org/cves/CVE-2026-86698.html
   • https://github.com/hexpm/hexpm/commit/650faa03af511e74c1b3b49ec12d35666b6984c4
   • https://github.com/hexpm/hexpm/commit/db58cf3a86c7639708ef52ff86de0b4f938e6360
   • https://github.com/hexpm/hexpm/security/advisories/GHSA-vmw7-7g2w-gw2f

   and 1 more reference

   Show 9 original changes

   Individual changes of this event as published by NVD

   Type	Action	Before	After
   Description	added	—	Insufficient Session Expiration vulnerability in OAuth token issuance in hexpm hexpm allows a user whose organization membership or session has ended to keep reading the organization's private packages and their documentation tarballs via a retained refresh token. generate_refresh_token/4 in lib/hexpm/oauth/jwt.ex signs the refresh token with the same iss, aud and scope claims as the access token, so it carries the same repository:<org> scopes. The CDN service that serves private repositories verifies the signature and time claims and then authorizes from the scope claim, with no database lookup and no way to tell the two token kinds apart. Removing a member or revoking a session therefore takes effect at the CDN only when the 30 day refresh token expires, instead of after the 30 minute access token lifetime. Access is read-only and limited to organizations the account belonged to when the token was granted. This issue affects hex.pm: from 2025-10-10 before 2026-09-22.
   CVSS	added	—	AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
   Weakness type (CWE)	added	—	CWE-613
   Affected versions (publisher)	added	—	New affected value received. <a href="https://github.com/CVEProject/cvelistV5/blob/main/cves/2026/86xxx/CVE-2026-86698.json">CVE-2026-86698</a>
   Reference	added	—	https://cna.erlef.org/cves/CVE-2026-86698.html
   Reference	added	—	https://github.com/hexpm/hexpm/commit/650faa03af511e74c1b3b49ec12d35666b6984c4
   Reference	added	—	https://github.com/hexpm/hexpm/commit/db58cf3a86c7639708ef52ff86de0b4f938e6360
   Reference	added	—	https://github.com/hexpm/hexpm/security/advisories/GHSA-vmw7-7g2w-gw2f
   Reference	added	—	https://osv.dev/vulnerability/EEF-CVE-2026-86698

   Source identifier: 6b3ad84c-e1a6-4bf7-a703-f496b71e49db