CVE-2026-97406
XERJ Console API bearer tokens can bypass the passkey‑only authentication requirement and directly invoke the API‑token creation endpoint, allowing unauthorized minting of persistent successor credentials.
- EPSS
- 0.2% chance of exploitation in the next 30 days; higher than 12% of CVEs (scores of 2026-10-25)
- Published
- Modified
- Record from
- the NVD, synced