External risk intelligence

XERJ Console API Token Creation Bypass

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-97406

The vulnerability resides in a Console API that handles token creation and authentication. Such APIs are commonly exposed as internet-facing management surfaces or gateway services in modern deployment patterns, making them accessible to network-based interaction.

Missing Authentication

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a critical security vulnerability within the XERJ Console API, which could allow unauthorized access to create persistent credentials. The issue involves bypassing existing authentication to mint new tokens, potentially leading to significant security breaches. While the primary concern is confirming if your organization uses this specific technology and is thus exposed, the nature of the bypass presents a severe risk if exploited.

API flaw bypasses security for credential creation.
Enables unauthorized access to user accounts.
Confirm usage; critical if present.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by directly interacting with the XERJ Console API. Since no authentication is required to reach the token creation endpoint, an unauthenticated attacker can bypass the intended passkey-only protection. This bypass allows them to generate new, persistent credentials without proper authorization, potentially leading to unauthorized access and control over the system.

Unauthenticated network access to API.
Invoking token creation endpoint.
Unauthorized credential creation.

Live Threat

Current exploitation, exposure, and threat context

The XERJ Console API could allow an unauthenticated attacker to bypass passkey-only authentication and create new API tokens. This could lead to unauthorized minting of persistent credentials, potentially enabling further compromise of systems that rely on these tokens for access.

API tokens and associated system access.
Bypassing authentication via direct API invocation.
Unauthorized creation of successor credentials.

Operational Fix

Recommended remediation, mitigation, and detection steps

The XERJ Console API's handling of bearer tokens presents a critical risk, allowing unauthorized creation of credentials by bypassing passkey-only authentication. This vulnerability requires immediate attention from teams responsible for API security and identity management. The first practical step is to identify all instances of the XERJ Console API within your environment, determine their network exposure and business criticality, and then locate the accountable system owner to coordinate a remediation plan based on the assessed risk.

Application owners and API security teams.
Verify network exposure and authentication bypass.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the XERJ Console API?

The XERJ Console API is a software component used for managing system identity and access control. It serves as a backend service responsible for generating and validating the security credentials that govern how users and applications interact with the XERJ platform, specifically handling the creation of tokens used to secure communications.

What does CVE-2026-97406 mean?

This vulnerability involves a failure in authentication and authorization, classified as CWE-306 (Missing Authentication) and CWE-863 (Incorrect Authorization). Essentially, the system's security controls are flawed, allowing someone to interact with a restricted endpoint that mints new credentials without first providing the required passkey or proving their identity.

How can an attacker trigger this bug?

An attacker triggers this by sending a direct network request to the specific API endpoint responsible for token creation. The bug allows this action to bypass the mandatory passkey requirement entirely. Simply accessing the API's general dashboard or other read-only functions does not trigger this; the flaw is specific to the unauthorized invocation of the credential-generation process.

Do I need to worry if my XERJ console is internal?

Halo Surface Signal indicates that this API is frequently deployed as an internet-facing management gateway, which makes it highly accessible. If your instance is purely internal, the immediate risk from remote actors is lower, but the vulnerability remains a critical security gap that could be used for lateral movement by an attacker who has already gained a foothold inside your network.

How do I respond to this threat?

Begin by inventorying your environment to locate every instance where the XERJ Console API is deployed. Once identified, evaluate the network accessibility and importance of each instance. Coordinate with the system owners to prioritize these assets for remediation, focusing on blocking unauthorized network paths to the API until official security updates are applied.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.