CVE-2026-21622

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Insufficient Session Expiration vulnerability in hexpm hexpm/hexpm ('Elixir.Hexpm.Accounts.PasswordReset' module) allows Account Takeover.

Password reset tokens generated via the "Reset your password" flow do not expire. When a user requests a password reset, Hex sends an email containing a reset link with a token. This token remains valid indefinitely until used. There is no time-based expiration enforced.

If a user's historical emails are exposed through a data breach (e.g., a leaked mailbox archive), any unused password reset email contained in that dataset could be used by an attacker to reset the victim's password. The attacker does not need current access to the victim's email account, only access to a previously leaked copy of the reset email.

This vulnerability is associated with program files lib/hexpm/accounts/password_reset.ex and program routines 'Elixir.Hexpm.Accounts.PasswordReset':can_reset?/3.

This issue affects hexpm: from 617e44c71f1dd9043870205f371d375c5c4d886d before bb0e42091995945deef10556f58d046a52eb7884.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-613

Affected software

No affected versions have been published.

Timeline

Published
Mar 5, 2026
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2026

CVE-2026-216235.4Lack of input filterung leads to a persistent XSS vulnerability in the forum post handling of the Easy Discuss component for Joomla.CVE-2026-216245.4Lack of input filterung leads to a persistent XSS vulnerability in the user avatar text handling of the Easy Discuss component for Joomla.CVE-2026-216258.8User provided uploads to the Easy Discuss component for Joomla aren't properly validated. Uploads are purely checked by file extensions, no CVE-2026-216267.5Access control settings for forum post custom fields are not applied to the JSON output type, leading to an ACL violation vector an informatCVE-2026-216279.5The vulnerability was rooted in how the Tassos Framework plugin handled specific AJAX requests through Joomla’s com_ajax entry point. Under CVE-2026-216289.8A improperly secured file management feature allows uploads of dangerous data types for unauthenticated users, leading to remote code executCVE-2026-216297.3The ajax component was excluded from the default logged-in-user check in the administrative area. This behavior was potentially unexpected bCVE-2026-21637.2A vulnerability was identified in D-Link DIR-600 up to 2.15WWb02. This vulnerability affects unknown code of the file ssdp.cgi. Such manipulCVE-2026-216308.8Improperly built order clauses lead to a SQL injection vulnerability in the articles webservice endpoint.CVE-2026-216315.4Lack of output escaping leads to a XSS vector in the multilingual associations component.CVE-2026-216325.4Lack of output escaping for article titles leads to XSS vectors in various locations.CVE-2026-216338.8A malicious actor with access to the adjacent network could obtain unauthorized access to a UniFi Protect Camera by exploiting a discovery p