CVE-2026-86698

Insufficient Session Expiration vulnerability in OAuth token issuance in hexpm hexpm allows a user whose organization membership or session has ended to keep reading the organization's private packages and their documentation tarballs via a retained refresh token. generaterefreshtoken/4 in...

CVE-2026-86698

The hexpm library (affecting hex.pm ) contains an insufficient session expiration vulnerability in its OAuth token issuance. The function generate_refresh_token/4 in lib/hexpm/oauth/jwt.ex signs refresh tokens with the same iss, aud, and scope claims as access tokens. Because the CDN service serv...