CVE-2026-21622
Severity CVSS v4.0:
CRITICAL
Type:
Unavailable / Other
Publication date:
05/03/2026
Last modified:
05/03/2026
Description
Insufficient Session Expiration vulnerability in hexpm hexpm/hexpm (&#39;Elixir.Hexpm.Accounts.PasswordReset&#39; module) allows Account Takeover.<br />
<br />
Password reset tokens generated via the "Reset your password" flow do not expire. When a user requests a password reset, Hex sends an email containing a reset link with a token. This token remains valid indefinitely until used. There is no time-based expiration enforced.<br />
<br />
If a user&#39;s historical emails are exposed through a data breach (e.g., a leaked mailbox archive), any unused password reset email contained in that dataset could be used by an attacker to reset the victim&#39;s password. The attacker does not need current access to the victim&#39;s email account, only access to a previously leaked copy of the reset email.<br />
<br />
This vulnerability is associated with program files lib/hexpm/accounts/password_reset.ex and program routines &#39;Elixir.Hexpm.Accounts.PasswordReset&#39;:can_reset?/3.<br />
<br />
This issue affects hexpm: from 617e44c71f1dd9043870205f371d375c5c4d886d before bb0e42091995945deef10556f58d046a52eb7884.
Impact
Base Score 4.0
9.50
Severity 4.0
CRITICAL