Xerj Console API Authentication Bypass Leads to Unauthorized Credential Minting

{
  "id": "d532f02e532f4686e8c82ecf1af57525e1b6d25fcb500acc7284056707163564",
  "url": "https://kb.cert.org/vuls/id/645818",
  "method": "llm",
  "payload": {
    "kind": "advisory",
    "title": "Xerj Console API Authentication Bypass Leads to Unauthorized Credential Minting",
    "summary": "A flaw in Xerj’s Console API allows someone with a valid API token to mint successor credentials without passkey-backed authorization. No official patch was available when the notice was published.",
    "evidence": "The vendor could not be reached to coordinate this vulnerability and an official patch has not been made available at the time of this writing.",
    "products": [
      {
        "name": {
          "value": "Xerj",
          "evidence": "Xerj Unknown"
        },
        "prerequisites": [],
        "fixed_versions": [],
        "affected_versions": []
      }
    ],
    "severity": "unknown",
    "fixed_cves": [],
    "related_cves": [
      {
        "value": "CVE-2026-97406",
        "evidence": "The vulnerability, CVE-2026-97406, stems from a flaw in how session states are authenticated and handled within the Xerj system architecture."
      }
    ],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "official-cert-cc-vulnerability-notes",
  "document_id": 23361,
  "published_at": "2026-10-20T18:09:44.46+00:00"
}