CVE-2026-119446: Session Fixation

Description

Session Fixation vulnerability in the CLI login flow in nerves-hub nerves_hub_web allows an unauthenticated attacker to obtain an API token for another user's account via a crafted login link. Starting a CLI login with POST /api/auth/cli_session needs no authentication and returns a polling token, a confirmation URL that carries that token, and a confirmation code. When a signed-in user opens that URL and clicks Confirm, NervesHub.Accounts.verify_cli_session_token/2 creates an API token for the user's account and stores it on the login, and the next poll of GET /api/auth/cli_session/<token> returns it to whoever started the login. The confirmation code is only displayed and is never compared with anything, so it cannot show that the person confirming is the one who started the login. The confirm form carries a CSRF token and the page cannot be framed, so the attacker has to persuade the user to open the link and click the button themselves. This issue affects nerves_hub: from 2.5.0 before 2.5.3.

Is your site exposed to CVE-2026-119446?

Run a free security scan — no signup, results in seconds.

Weakness Type (CWE)

CWE-384 CWE-384

References

Other References

https://cna.erlef.org/cves/CVE-2026-119446.html https://github.com/nerves-hub/nerves_hub_web/commit/3131f1701194b581ab4b3e5e9d81194fc9c83508 https://github.com/nerves-hub/nerves_hub_web/commit/e6bf11a812d7aa8b69d854ba8ef02d65516f5564 https://github.com/nerves-hub/nerves_hub_web/security/advisories/GHSA-9vr9-463q-46qp https://osv.dev/vulnerability/EEF-CVE-2026-119446

Frequently Asked Questions

What is CVE-2026-119446? +

Session Fixation vulnerability in the CLI login flow in nerves-hub nerves_hub_web allows an unauthenticated attacker to obtain an API token for another user's account via a crafted login link. Starting a CLI login with POST /api/auth/cli_session needs no authentication and returns a polling token, a confirmation URL that carries that token, and a confirmation code. When a signed-in user opens that URL and clicks Confirm, NervesHub.Accounts.verify_cli_session_token/2 creates an API token for the user's account and stores it on the login, and the next poll of GET /api/auth/cli_session/<token> returns it to whoever started the login. The confirmation code is only displayed and is never compared with anything, so it cannot show that the person confirming is the one who started the login. The confirm form carries a CSRF token and the page cannot be framed, so the attacker has to persuade the user to open the link and click the button themselves. This issue affects nerves_hub: from 2.5.0 before 2.5.3.

How do I check if I'm vulnerable to CVE-2026-119446? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2026-97890

The embedded HTTP server does not invalidate the previous session identifier when an application changes the session id, e.g. after …

CVE-2025-24502

An improper session validation allows an unauthenticated attacker to cause certain request notifications to be executed in the context of …

CVE-2026-101268

If an attacker is able to convince a victim on a specially crafted link, the victim is logged in to …

CVE-2026-82840

Session fixation in Apache Wicket. org.apache.wicket.authroles.authentication.AuthenticatedWebSession is the authentication base class of Wicket's role-based security module, and its signIn(String, String) …

CVE-2026-86688

Session Fixation vulnerability in team-alembic ash_authentication allows an attacker who can plant a session identifier in a victim's browser to …

CVE-2025-24503

A malicious actor can fix the session of a PAM user by tricking the user to click on a specially …