CVE-2026-97406 Details

An authentication bypass vulnerability has been identified in the Xerj Console API, allowing sessions to circumvent passkey-backed authentication requirements when issuing new API tokens. This flaw enables an attacker with a valid token to directly access the token creation endpoint, unauthorizedly generating persistent successor credentials. The vulnerability arises from the API's handling of session authentication, where both browser and API bearer tokens are treated as generic 'AuthSession' objects. This oversight allows for the creation of new tokens without proper verification of the original session's authentication method. Additionally, the lack of a hierarchical revocation system means that revoking an original token does not affect any successor tokens created from it.