CVE-2026-21622 Details
Description
Insufficient Session Expiration vulnerability in hexpm hexpm/hexpm ('Elixir.Hexpm.Accounts.PasswordReset' module) allows Account Takeover. Password reset tokens generated via the "Reset your password" flow do not expire. When a user requests a password reset, Hex sends an email containing a reset link with a token. This token remains valid indefinitely until used. There is no time-based expiration enforced. If a user's historical emails are exposed through a data breach (e.g., a leaked mailbox archive), any unused password reset email contained in that dataset could be used by an attacker to reset the victim's password. The attacker does not need current access to the victim's email account, only access to a previously leaked copy of the reset email. This vulnerability is associated with program files lib/hexpm/accounts/password_reset.ex and program routines 'Elixir.Hexpm.Accounts.PasswordReset':can_reset?/3. This issue affects hexpm: from 617e44c71f1dd9043870205f371d375c5c4d886d before bb0e42091995945deef10556f58d046a52eb7884.
A vulnerability in the Hexpm package management system's password reset functionality allows for account takeover due to password reset tokens not expiring. Tokens generated through the 'Reset your password' process remain valid indefinitely, creating a risk if a user's email is exposed in a data breach. An attacker could use an old reset token to change the user's password without needing access to their email account. This issue affects Hexpm versions from 617e44c71f1dd9043870205f371d375c5c4d886d prior to bb0e42091995945deef10556f58d046a52eb7884.
The vulnerability has been patched in Hexpm version bb0e42091995945deef10556f58d046a52eb7884. Users who suspect their email has been compromised should reset their password and enable two-factor authentication.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 10, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-613 | Insufficient Session Expiration | EEF |
Affected Products
| Product | Versions |
|---|---|
| hex hexpm | >= 2025-10-01, < 2026-03-05 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | EEF |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 6, 2026 | CVE Modified | EEF |
| Mar 19, 2026 | Reanalysis | [email protected] |
| Mar 17, 2026 | Initial Analysis | [email protected] |
| Mar 5, 2026 | New CVE Received | EEF |