CVE-2026-97406

XERJ Console API bearer tokens can bypass the passkey‑only authentication requirement and directly invoke the API‑token creation endpoint, allowing unauthorized minting of persistent successor credentials...

CVE-2026-97406 Authentication Bypass via Bearer Tokens to Unauthorized Credential Minting

XERJ Console API bearer tokens can bypass the passkey‑only authentication requirement and directly invoke the API‑token creation endpoint, allowing unauthorized minting of persistent successor credentials...

CVE-2026-97406

The Xerj open-source search and indexing engine (specifically version v1.0.0-rc.11 ) contains an authentication bypass vulnerability in its Console API . The root cause is an architectural oversight where both standard browser sessions and API bearer tokens are converted into a generic AuthSessio...

CVE-2026-97406 Authentication Bypass via Bearer Tokens to Unauthorized Credential Minting

XERJ Console API bearer tokens can bypass the passkey‑only authentication requirement and directly invoke the API‑token creation endpoint, allowing unauthorized minting of persistent successor credentials...

EUVD-2026-105251

XERJ Console API bearer tokens can bypass the passkey‑only authentication requirement and directly invoke the API‑token creation endpoint, allowing unauthorized minting of persistent successor credentials...

PT-2026-118609

Name of the Vulnerable Software and Affected Versions XERJ Console API affected versions not specified Description An authentication bypass exists where bearer tokens can be used to circumvent the passkey-only authentication requirement. This allows an attacker to directly invoke the API-token...