CVE-2026-119446

The nerves-hub nerves_hub_web component (versions 2.5.0 to 2.5.2 ) is vulnerable to a Session Fixation vulnerability in its CLI login flow. An unauthenticated attacker can initiate a login via POST /api/auth/cli_session to receive a polling token and a confirmation URL. By persuading a signed-in ...