CVE-2026-97406: CWE-306 Missing Authentication for Critical Function in Xerj Console API
Affects Xerj Console APISource CVE Database V5
No CVSS score published yet
- Exploitation
Not in CISA KEV, no exploitation reported
- EPSS
- 0.3% chance of exploitation in 30 days – higher than 15% of CVEs
What to do
AI-suggested
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or fix information is provided, users should monitor the CERT advisory for updates. Until a fix is available, restrict access to the affected API version and consider additional access controls or network-level protections to limit exposure.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| XerjConsole API | Affected
| Fixed in– |
npmxerj/console-apipkg:npm/xerj/console-apiOther threats | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
Description
CVE-2026-97406 is a vulnerability in the Xerj Console API version 1.0.0-rc.11 where bearer tokens can bypass the passkey-only authentication requirement. This allows unauthorized users to invoke the API-token creation endpoint and mint persistent successor credentials without proper authentication.