News
cybersecurity The Internet goes on high alert after discovery of 8 compromised TLS certs - Ars Technica Security cybersecurity Zeabur shutting down after second security breach in two months - BleepingComputer cybersecurity Ex-OpenAI Engineer Held Over Secret Recorder, Saudi Ties - Dark Reading vulnerability VU#645818: Xerj Console API Authentication Bypass Leads to Unauthorized Credential Minting - CERT/CC Vulnerability Notes cybersecurity 5 Ways American SOCs and MSSPs Can Stay Ahead of Ransomware Threats - CyberPress cybersecurity US Agencies Detail Incident Response Practices for Rogue AI Agents - SecurityWeek cybersecurity Critical FortiSIEM Flaw Gets Public Exploit PoC for Unauthenticated Remote Code Execution - The Hacker News cybersecurity Close Identity Gaps in Software Development Before Unleashing AI - Dark Reading cybersecurity Qilin and INC Ransomware Groups Exploit Palo Alto Networks Flaw to Bypass MFA - The Hacker News ai The new economics of enterprise AI - MIT Technology Review cybersecurity Scammers Impersonate Poshmark Through Trusted Payment Emails to Steal Card Details and OTPs - CyberPress cybersecurity Hackers Abuse AI Pen-Test Tool Cairn to Automate Massive Attack Spree - Dark Reading cybersecurity Hackers Use Autonomous AI Agents to Breach Company Websites, Target Over 1,200 Sites - The Hacker News cybersecurity AOMEI Backupper Compromised in Short-Burst Supply Chain Campaign - SecurityWeek cybersecurity Hacker gets 8 years for stealing $3.3 million from taxpayers - BleepingComputer
1 / 15
All news ›
Vulnerability

VU#645818: Xerj Console API Authentication Bypass Leads to Unauthorized Credential Minting

CERT/CC Vulnerability Notes ·

Overview An authentication bypass vulnerability in the Xerj Console API allows sessions to bypass passkey-backed requirements during token issuance. By exploiting this flaw, an attacker with an existing valid token can create independent, persistent successor credentials directly through the console API. This allows the attacker to maintain access and potentially escalate privileges within the Xerj ecosystem, even if the initial token is revoked. Description Xerj is an open-source search and indexing engine tailored specifically for AI agents utilizing the Elasticsearch API, allowing AI models to query a structured index. The vulnerability, CVE-2026-97406 , stems from a flaw in how session states are authenticated and handled within the Xerj system architecture. According to the documented security contract, the issuance of new API tokens must be strictly authorized by a passkey-backed session. However, the Xerj implementation converts both standard browser sessions and API bearer toke

Continue on CERT/CC Vulnerability Notes ↗ ‹ All news Get the newsletter