VU#645818: Xerj Console API Authentication Bypass Leads to Unauthorized Credential Minting

Reported by CERT/CC

Summary by Cyber Security News20 Oct 2026, 20:09 CET

About this summary. This is a short excerpt from the description that CERT/CC published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://kb.cert.org/vuls/id/645818

Overview An authentication bypass vulnerability in the Xerj Console API allows sessions to bypass passkey-backed requirements during token issuance. By exploiting this flaw, an attacker with an existing valid token can create independent, persistent successor credentials directly through the console API. This allows the attacker to maintain access and potentially escalate privileges within the Xerj ecosystem, even if the initial token is revoked.

Read the full article at CERT/CC →

Source attribution: headline and facts are from CERT/CC (kb.cert.org). Summary method: excerpt of the source description. See our source attribution policy.