Read the docs
TI-2026-17414 Aliases CVE-2026-21622

Password Reset Tokens Do Not Expire

Priority MEDIUM 49CWE-613Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-613.

Summary

Insufficient Session Expiration vulnerability in hexpm hexpm/hexpm ('Elixir.Hexpm.Accounts.PasswordReset' module) allows Account Takeover. Password reset tokens generated via the "Reset your password" flow do not expire. When a user requests a password reset, Hex sends an email containing a reset link with a token. This token remains valid indefinitely until used. There is no time-based expiration enforced. If a user's historical emails are exposed through a data breach (e.g., a leaked mailbox archive), any unused password reset email contained in that dataset could be used by an attacker to reset the victim's password. The attacker does not need current access to the victim's email account, only access to a previously leaked copy of the reset email. This vulnerability is associated with program files lib/hexpm/accounts/password_reset.ex and program routines 'Elixir.Hexpm.Accounts.PasswordReset':can_reset?/3. This issue affects hexpm: from 617e44c71f1dd9043870205f371d375c5c4d886d before bb0e42091995945deef10556f58d046a52eb7884.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00444 38th percentileScored 2026-11-07
Fix Fixed hex.pm (hexpm): 2026-03-05

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
hexpmhex.pm2025-08-01 to before 2026-03-052026-03-05Patch availableCNA
  • hex.pm Vendorhexpm Affected 2025-08-01 to before 2026-03-05 Fixed in 2026-03-05 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:hex:hexpm:*:*:*:*:*:*:*:*2025-10-01 to before 2026-03-05Vulnerablehexpm
  • cpe:2.3:a:hex:hexpm:*:*:*:*:*:*:*:* Versions 2025-10-01 to before 2026-03-05 Vulnerable ·hexpm

Remediation

  • Fix · CNA hex.pm (hexpm) Fixed in 2026-03-05

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    hexpm hex.pm 2026-03-05

    2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2026-17413 Improper Scope Enforcement in OAuth client_credentials Flow Allows Read-Only API Key to Escalate to Full AccessPriority LOW 31
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-21622

References

Patch 2

Other 2

  • TI-2026-17410 Cross-site scripting (XSS) in OAuth Device Authorization screen CVSS 4.0HIGH 8.5
  • TI-2026-19283 Denial of Service via Oversized Package Upload CVSS 4.0HIGH 7.1
  • TI-2026-19282 Path Traversal in Local File Store Backend CVSS 4.0MEDIUM 6.9
  • TI-2026-17413 Improper Scope Enforcement in OAuth client_credentials Flow Allows Read-Only API Key to Escalate to Full Access CVSS 4.0HIGH 7.0

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences