CVE-2026-86698

The hexpm library (affecting hex.pm ) contains an insufficient session expiration vulnerability in its OAuth token issuance. The function generate_refresh_token/4 in lib/hexpm/oauth/jwt.ex signs refresh tokens with the same iss, aud, and scope claims as access tokens. Because the CDN service serv...