High 7.0Published Mar 5, 2026

CVE-2026-21621Improper Scope Enforcement in OAuth client_credentials Flow Allows Read-Only API Key to Escalate to Full Access

Updated under an hour ago (Oct 28, 2026, 6:30 AM ET)

Does this affect you?

It affects hexpm and 2 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for hexpm

Exploited in the last 30 days

Incorrect Authorization vulnerability in hexpm hexpm/hexpm ('Elixir.HexpmWeb.API.OAuthController' module) allows Privilege Escalation. An API key created with read-only permissions (domain: "api", resource: "read") can be escalated to full write access under specific conditions. When exchanging a read-only API key via the OAuth client_credentials grant, the resource qualifier is ignored. The resulting JWT receives the broad "api" scope instead of the expected "api:read" scope. This token is therefore treated as having full API access. If an attacker is able to obtain a victim's read-only API key and a valid 2FA (TOTP) code for the victim account, they can use the incorrectly scoped JWT to create a new full-access API key with unrestricted API permissions that does not expire by default and can perform write operations such as publishing, retiring, or modifying packages. This vulnerability is associated with program files lib/hexpm_web/controllers/api/oauth_controller.ex and program routines 'Elixir.HexpmWeb.API.OAuthController':validate_scopes_against_key/2. This issue affects hexpm: from 71829cb6f6559bcceb1ef4e43a2fb8cdd3af654b before 71c127afebb7ed7cc637eb231b98feb802d62999.

CVSS: 7.0 HIGH (v4.0, CNA)CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:H/SA:N
Weakness (CWE): CWE-863
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: EEF
NVD analysis: Modified
Record last updated: Apr 6, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

hexpm hexpm hexpm:hexpm	71829cb6f6559bcceb1ef4e43a2fb8cdd3af654b builds before 71c127afebb7ed7cc637eb231b98feb802d62999	CNA record
hexpm hex.pm hexpm:hex.pm (from the name)	from 2025-08-18 before 2026-03-05	CNA record
hex hexpm hex:hexpm	from 2025-10-17 before 2026-03-05	NVD

References

References

https://github.com/hexpm/hexpm/security/advisories/GHSA-739m-8727-j6w3	vendor-advisory, related, mitigation
https://cna.erlef.org/cves/CVE-2026-21621.html	related
https://osv.dev/vulnerability/EEF-CVE-2026-21621	related
https://github.com/hexpm/hexpm/commit/71c127afebb7ed7cc637eb231b98feb802d62999	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.