CVE-2026-97406: Authentication Bypass via Bearer Tokens to Unauthorized Credential Minting

Published Oct 20, 2026

Updated

XERJ Console API bearer tokens can bypass the passkey‑only authentication requirement and directly invoke the API‑token creation endpoint, allowing unauthorized minting of persistent successor credentials.

Affected Software

1 affected component

XERJ Console API

Event History

Oct 20, 2026

CVE Published

via MITRE·06:11 PM

Data Sourced

via MITRE·06:11 PM

DescriptionWeakness

Data Sourced

via NVD·07:19 PM

Description

Frequently Asked Questions

What access does an attacker need to exploit this issue?

The attacker needs a bearer token accepted by the XERJ Console API. The available information does not specify how such a token might be obtained.

What can an attacker gain by exploiting it?

An attacker can invoke the API-token creation endpoint despite the passkey-only authentication requirement and mint persistent successor credentials.

Does the issue affect passkey-only authentication deployments?

Yes. The bypass specifically allows bearer tokens to circumvent the passkey-only authentication requirement for API-token creation.

CVE-2026-97406: Authentication Bypass via Bearer Tokens to Unauthorized Credential Minting

Affected Software

Event History

Frequently Asked Questions

What access does an attacker need to exploit this issue?

What can an attacker gain by exploiting it?

Does the issue affect passkey-only authentication deployments?

Company

Resources

Contact

Frequently Asked Questions

What access does an attacker need to exploit this issue?

What can an attacker gain by exploiting it?

Does the issue affect passkey-only authentication deployments?