Xerj vulnerabilities

Products

• Console API 1

Latest Xerj CVEs

Newest publication first

1. CVE-2026-97406 Authentication Bypass via Bearer Tokens to Unauthorized Credential Minting

   Published 2026-10-20

   Critical·CVSS 9.1 EPSS 0.53%

   XERJ Console API bearer tokens can bypass the passkey‑only authentication requirement and directly invoke the API‑token creation endpoint, allowing unauthorized minting of persistent successor credentials.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.