CVE-2026-119446 Session fixation in the CLI login flow allows an unauthenticated attacker to obtain a user's API token

Session Fixation vulnerability in the CLI login flow in nerves-hub nerveshubweb allows an unauthenticated attacker to obtain an API token for another user's account via a crafted login link. Starting a CLI login with POST /api/auth/clisession needs no authentication and returns a polling token, a...

CVE-2026-119446

The nerves-hub nerves_hub_web component (versions 2.5.0 to 2.5.2 ) is vulnerable to a Session Fixation vulnerability in its CLI login flow. An unauthenticated attacker can initiate a login via POST /api/auth/cli_session to receive a polling token and a confirmation URL. By persuading a signed-in ...

EEF-CVE-2026-120286 Missing authorization in device and deployment group page events allows view-role members to change devices and deployment groups

Summary Missing Authorization vulnerability in the device and deployment group pages in nerves-hub nerveshubweb allows an authenticated organization member with the view role to change devices and deployment groups via LiveView events reserved for the manage role. The event handlers that add and...

CVE-2026-120286

A Missing Authorization vulnerability in nerves_hub_web (versions 1.0.0 before 2.5.3) allows authenticated members with the view role to perform actions reserved for the manage role. The root cause is that specific LiveView event handlers—including those for certificate management, tag manipulati...

CVE-2026-120997

The nerves_hub nerves_hub_web component (versions 1.0.0 before 2.5.3 ) is vulnerable to Improper Session Invalidation (CWE-1464, CWE-1465). The dashboard, device console, and local shell channels only verify user roles once at page mount or socket join. Consequently, a removed or demoted member c...

CVE-2026-120730

The nerves_hub software (nerves_hub_web ) is vulnerable to an Improperly Controlled Modification of Dynamically-Determined Object Attributes (CWE-639, CWE-915) in the device API, signing key forms, product forms, and JITP settings. An authenticated user with the manage role in their own organizat...

CVE-2026-120999

The nerves-hub nerves_hub_web component (versions 2.3.0 before 2.5.3 ) is vulnerable to an Improper Authentication flaw in its Google sign-in and email confirmation workflows. The root cause is that NervesHub.Accounts.update_or_create_user_from_ueberauth/1 signs in Google users to any existing ac...

CVE-2026-120295

An Incorrect Authorization vulnerability in nerves_hub nerves_hub_web (versions 1.0.0 before 2.5.3) allows an authenticated user with a manage role in one organization and only a view role in another to move their own devices into a product belonging to the second organization. The flaw exists be...