CVE-2026-21621 Improper Scope Enforcement in OAuth client_credentials Flow Allows Read-Only API Key to Escalate to Full Access

[
  {
    "collectionURL": "https://github.com",
    "cpes": [
      "cpe:2.3:a:hexpm:hexpm:*:*:*:*:*:*:*:*"
    ],
    "defaultStatus": "unaffected",
    "modules": [
      "'Elixir.HexpmWeb.API.OAuthController'"
    ],
    "packageName": "hexpm/hexpm",
    "packageURL": "pkg:github/hexpm/hexpm",
    "product": "hexpm",
    "programFiles": [
      "lib/hexpm_web/controllers/api/oauth_controller.ex"
    ],
    "programRoutines": [
      {
        "name": "'Elixir.HexpmWeb.API.OAuthController':validate_scopes_against_key/2"
      }
    ],
    "repo": "https://github.com/hexpm/hexpm.git",
    "vendor": "hexpm",
    "versions": [
      {
        "lessThan": "71c127afebb7ed7cc637eb231b98feb802d62999",
        "status": "affected",
        "version": "71829cb6f6559bcceb1ef4e43a2fb8cdd3af654b",
        "versionType": "git"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "hex.pm",
    "vendor": "hexpm",
    "versions": [
      {
        "lessThan": "2026-03-05",
        "status": "affected",
        "version": "2025-08-18",
        "versionType": "date"
      }
    ]
  }
]