CVE-2026-119446criticalCWE-384

CVE-2026-119446: critical vulnerability in nerves-hub nerves_hub_web

Session fixation in the CLI login flow allows an unauthenticated attacker to obtain a user's API token

Published · Updated

Follow this CVE+ Monitor nerves hub web

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

28Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 9.4epss 0.5%
Session Fixation vulnerability in the CLI login flow in nerves-hub nerves_hub_web allows an unauthenticated attacker to obtain an API token for another user's account via a crafted login link. Starting a CLI login with POST /api/auth/cli_session needs no authentication and returns a polling token, a confirmation URL that carries that token, and a confirmation code. When a signed-in user opens that URL and clicks Confirm, NervesHub.Accounts.verify_cli_session_token/2 creates an API token for the user's account and stores it on the login, and the next poll of GET /api/auth/cli_session/<token> returns it to whoever started the login. The confirmation code is only displayed and is never compared with anything, so it cannot show that the person confirming is the one who started the login. The confirm form carries a CSRF token and the page cannot be framed, so the attacker has to persuade the user to open the link and click the button themselves. This issue affects nerves_hub: from 2.5.0 before 2.5.3.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Affected products
nerves-hub · nerves_hub_web
Related CVEs — nerves-hub nerves_hub_web

In the same product, most dangerous first.

CVE-2025-64097CRITICALNervesHub has Insufficient Token Entropy that Allows Authentication Bypass via Brute ForceEPSS 0.5%CVE-2026-28806CRITICALImproper authorization in device bulk actions and device update API allows cross-organization device controlEPSS 0.5%CVE-2026-120730HIGHMass assignment of organization, product and deployment group IDs allows users to write into other organizations and receive their firmwareEPSS 0.4%CVE-2026-120997LOWImproper session invalidation keeps removed or demoted members' open pages and device consoles working at their old roleEPSS 0.3%CVE-2026-120295HIGHIncorrect authorization in the devices page bulk move allows view-role members to move devices into another organization and receive its firmwareEPSS 0.2%CVE-2026-120286MEDIUMMissing authorization in device and deployment group page events allows view-role members to change devices and deployment groupsEPSS 0.2%