30 matches found
confused
Confused 비공개 패키지 이름에 대한 지속적인 자유 네임스페이스를 확인하는 도구로, Python PyPI requirements.txt, JavaScript npm package.json, PHP composer composer.json 또는 MVN Maven pom.xml의 종속성 구성을 참조합니다. 이건 무엇에 관한 것인가요? 2021년 2월 9일, 보안 연구원 Alex Birsan이 Medium에 글을 게시하여 여러 프로그래밍 언어 생태계에 존재하는 종속성 관리 도구의 다양한 해결 순서 취약점을 다루었습니다...
CVE-2026-86698 Refresh tokens accepted as private repository credentials at the CDN
Insufficient Session Expiration vulnerability in OAuth token issuance in hexpm hexpm allows a user whose organization membership or session has ended to keep reading the organization's private packages and their documentation tarballs via a retained refresh token. generaterefreshtoken/4 in...
CVE-2026-86698: Insufficient Session Expiration
Insufficient Session Expiration vulnerability in OAuth token issuance in hexpm hexpm allows a user whose organization membership or session has ended to keep reading the organization's private packages and their documentation tarballs via a retained refresh token. generaterefreshtoken/4 in...
CVE-2026-75554
Insufficient Session Expiration vulnerability in the OAuth token refresh grant in hexpm hexpm allows a user removed from an organization to keep reading its private packages. expandrepositoriesscope/3 in lib/hexpm/permissions.ex only rewrites the literal repositories scope, so an explicitly grant...
EUVD-2026-65120
Insufficient Session Expiration vulnerability in the OAuth token refresh grant in hexpm hexpm allows a user removed from an organization to keep reading its private packages. expandrepositoriesscope/3 in lib/hexpm/permissions.ex only rewrites the literal repositories scope, so an explicitly grant...
CVE-2026-75554
CVE-2026-75554 is an Insufficient Session Expiration vulnerability in the OAuth token refresh grant of hex.pm (the Hackage Package Manager). The root cause lies in expand_repositories_scope/3 in lib/hexpm/permissions.ex, which only rewrites the literal repositories scope. Explicitly granted repos...
EEF-CVE-2026-75554 Explicit organization scopes survive token refresh after membership ends
Summary Insufficient Session Expiration vulnerability in the OAuth token refresh grant in hexpm hexpm allows a user removed from an organization to keep reading its private packages. expandrepositoriesscope/3 in lib/hexpm/permissions.ex only rewrites the literal repositories scope, so an explicit...
CVE-2026-75554 Explicit organization scopes survive token refresh after membership ends
Insufficient Session Expiration vulnerability in the OAuth token refresh grant in hexpm hexpm allows a user removed from an organization to keep reading its private packages. expandrepositoriesscope/3 in lib/hexpm/permissions.ex only rewrites the literal repositories scope, so an explicitly grant...
CVE-2026-75554 Explicit organization scopes survive token refresh after membership ends
Insufficient Session Expiration vulnerability in the OAuth token refresh grant in hexpm hexpm allows a user removed from an organization to keep reading its private packages. expandrepositoriesscope/3 in lib/hexpm/permissions.ex only rewrites the literal repositories scope, so an explicitly grant...
CVE-2026-75542 OAuth token exchange grants repository scopes for organizations the principal cannot access
Incorrect Authorization vulnerability in the OAuth token endpoint in hexpm hexpm allows an API key holding the repositories permission to read another organization's private packages. When an API key is exchanged for a token through the OAuth clientcredentials grant, validatescopesagainstkey/2 in...
CVE-2026-75542
CVE-2026-75542 is an Incorrect Authorization flaw in the OAuth token endpoint of hex.pm (the Erlang/BEAM package registry). When an API key holding the repositories permission is exchanged for a token via the client_credentials grant, the function validate_scopes_against_key/2 in lib/hexpm_web/co...
CVE-2026-75542 OAuth token exchange grants repository scopes for organizations the principal cannot access
Incorrect Authorization vulnerability in the OAuth token endpoint in hexpm hexpm allows an API key holding the repositories permission to read another organization's private packages. When an API key is exchanged for a token through the OAuth clientcredentials grant, validatescopesagainstkey/2 in...
EUVD-2026-65119
Incorrect Authorization vulnerability in the OAuth token endpoint in hexpm hexpm allows an API key holding the repositories permission to read another organization's private packages. When an API key is exchanged for a token through the OAuth clientcredentials grant, validatescopesagainstkey/2 in...
EEF-CVE-2026-75542 OAuth token exchange grants repository scopes for organizations the principal cannot access
Summary Incorrect Authorization vulnerability in the OAuth token endpoint in hexpm hexpm allows an API key holding the repositories permission to read another organization's private packages. When an API key is exchanged for a token through the OAuth clientcredentials grant,...
PT-2026-81025
Name of the Vulnerable Software and Affected Versions hexpm versions 2025-10-18 through 2026-08-23 Description An incorrect authorization issue exists in the OAuth token endpoint. An API key with the repositories permission can be used to read private packages belonging to another organization...
PT-2026-81026
Name of the Vulnerable Software and Affected Versions hex.pm versions 2025-10-10 through 2026-08-23 Description An insufficient session expiration issue exists in the OAuth token refresh grant. The expand repositories scope/3 function in lib/hexpm/permissions.ex only rewrites the literal...
CVE-2026-75542: Incorrect Authorization
Incorrect Authorization vulnerability in the OAuth token endpoint in hexpm hexpm allows an API key holding the repositories permission to read another organization's private packages. When an API key is exchanged for a token through the OAuth clientcredentials grant, validatescopesagainstkey/2 in...
CVE-2026-75554: Insufficient Session Expiration
Insufficient Session Expiration vulnerability in the OAuth token refresh grant in hexpm hexpm allows a user removed from an organization to keep reading its private packages. expandrepositoriesscope/3 in lib/hexpm/permissions.ex only rewrites the literal repositories scope, so an explicitly grant...
