CVE-2026-97406

XERJ Console API bearer tokens can bypass the passkey‑only authentication requirement and directly invoke the API‑token creation endpoint, allowing unauthorized minting of persistent successor credentials...

EUVD-2026-105251

XERJ Console API bearer tokens can bypass the passkey‑only authentication requirement and directly invoke the API‑token creation endpoint, allowing unauthorized minting of persistent successor credentials...

CVE-2026-97406

The Xerj Console API , an open-source search and indexing engine, contains an authentication bypass vulnerability (CVE-2026-97406 ). The root cause is an architectural flaw where the system fails to distinguish between standard browser sessions and API bearer tokens, converting both into a generi...

CVE-2026-97406 Authentication Bypass via Bearer Tokens to Unauthorized Credential Minting

XERJ Console API bearer tokens can bypass the passkey‑only authentication requirement and directly invoke the API‑token creation endpoint, allowing unauthorized minting of persistent successor credentials...