https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 10:47:15 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-292166 EUVD-2026-292166 https://cve.radiocsirt.org/vuln/euvd-2026-292166 https://cve.radiocsirt.org/vuln/fkie_cve-2026-21622 <p>Insufficient Session Expiration vulnerability in hexpm hexpm/hexpm (&#39;Elixir.Hexpm.Accounts.PasswordReset&#39; module) allows Account Takeover.</p> <p>Password reset tokens generated via the &#34;Reset your password&#34; flow do not expire. When a user requests a password reset, Hex sends an email containing a reset link with a token. This token remains valid indefinitely until used. There is no time-based expiration enforced.</p> <p>If a user&#39;s historical emails are exposed through a data breach (e.g., a leaked mailbox archive), any unused password reset email contained in that dataset could be used by an attacker to reset the victim&#39;s password. The attacker does not need current access to the victim&#39;s email account, only access to a previously leaked copy of the reset email.</p> <p>This vulnerability is associated with program files lib/hexpm/accounts/password_reset.ex and program routines &#39;Elixir.Hexpm.Accounts.PasswordReset&#39;:can_reset?/3.</p> <p>This issue affects hexpm: from 617e44c71f1dd9043870205f371d375c5c4d886d before bb0e42091995945deef10556f58d046a52eb7884.</p> <p>Insufficient Session Expiration vulnerability in hexpm hexpm/hexpm (&#39;Elixir.Hexpm.Accounts.PasswordReset&#39; module) allows Account Takeover.</p> <p>Password reset tokens generated via the &#34;Reset your password&#34; flow do not expire. When a user requests a password reset, Hex sends an email containing a reset link with a token. This token remains valid indefinitely until used. There is no time-based expiration enforced.</p> <p>If a user&#39;s historical emails are exposed through a data breach (e.g., a leaked mailbox archive), any unused password reset email contained in that dataset could be used by an attacker to reset the victim&#39;s password. The attacker does not need current access to the victim&#39;s email account, only access to a previously leaked copy of the reset email.</p> <p>This vulnerability is associated with program files lib/hexpm/accounts/password_reset.ex and program routines &#39;Elixir.Hexpm.Accounts.PasswordReset&#39;:can_reset?/3.</p> <p>This issue affects hexpm: from 617e44c71f1dd9043870205f371d375c5c4d886d before bb0e42091995945deef10556f58d046a52eb7884.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-21622