VU#645818: Xerj Console API Authentication Bypass Leads to Unauthorized Credential Minting

CVE-2026-97406 is an authentication bypass vulnerability in the Xerj Console API. Xerj converts both browser sessions and API bearer tokens into a generic AuthSession object, and the token creation handler does not verify if the session was authenticated via a passkey as required by the security contract. Consequently, an attacker possessing a valid Xerj API token can invoke the token creation endpoint to mint independent successor credentials with the same privileges as the original token. The platform lacks hierarchical revocation logic, so revoking the parent token does not invalidate descendant tokens. This architectural flaw allows attackers to maintain persistent access, bypass multi-factor authentication controls, and escalate privileges, including gaining administrative control and enrolling attacker-controlled passkeys.

Exploitation allows persistent unauthorized access that bypasses multi-factor authentication. If the compromised token belongs to an account owner, the attacker can gain full administrative privileges, issue new account invitations, and enroll attacker-controlled passkeys. This results in permanent control over the Xerj instance and its sensitive data indices. Token revocation does not mitigate the threat due to the lack of hierarchical revocation logic.

No official patch or vendor advisory is currently available. Users should monitor the Xerj project's GitHub repository for updates and apply the latest version once a fix is released. Until then, no direct mitigation is confirmed.