EEF-CVE-2026-119446 Session fixation in the CLI login flow allows an unauthenticated attacker to obtain a user's API token

Summary Session Fixation vulnerability in the CLI login flow in nerves-hub nerveshubweb allows an unauthenticated attacker to obtain an API token for another user's account via a crafted login link. Starting a CLI login with POST /api/auth/clisession needs no authentication and returns a polling...