VU#645818: Xerj Console API Authentication Bypass Leads to Unauthorized Credential Minting
2026-10-21T20:52:02Z•87d95918dfea0e52abd6ca58637d3ef1865c5478ad11c92f54a46aa3c640b036
CVE-2026-100156CVE-2026-16753CVE-2026-34073CVE-2026-3547CVE-2026-3833CVE-2026-96679CVE-2026-96681CVE-2026-97406DevOpsIDORLLM-platformsName-ConstraintsOS-command-injectionRCESAN-validationTLSX.509XSSaccount-takeoverauthentication-bypassauthorization-bypasscontainer-managementcredential-mintingcross-tenant-data-exposuredata-exfiltrationprivilege-escalationroot-code-executiontoken-persistence
What happened
CERT/CC vulnerability notes covering authentication bypass, credential minting, cross-tenant authorization failures, IDOR, OS command injection, TLS/X.509 Name Constraints validation inconsistencies, and XSS with potential administrative compromise or RCE. Several records include critical-impact flaws enabling unauthenticated takeover, persistent credential access, root command execution, or sensitive data exfiltration. The supplied feed is truncated and includes multiple CVEs across distinct products.
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- certcc_vulnotes
- Record identifier
- 87d95918dfea0e52abd6ca58637d3ef1865c5478ad11c92f54a46aa3c640b036
- Enrichment time
- 2026-10-21T20:52:02Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.