CVE-2026-120997
LowCVSS 2.3Summary
Improper Session Invalidation vulnerability in the dashboard pages, device console and local shell channels in nerves-hub nerves_hub_web allows an organization member who is removed or given a lower role to keep acting at their old role through anything they had open at the time. The role is read once when a page mounts and membership is checked once at channel join, so changes are not propagated. The dashboard also opens consoles with a token valid for 24 hours that is not revoked by signing out.
Risk Assessment
A removed or demoted member can continue performing actions and running commands on devices until the page reloads or the socket disconnects. This can lead to unauthorized access and compromise of the device fleet.
Recommendation
Update nerves_hub to version 2.5.3 or later, which invalidates sessions on role changes, and consider shortening console token lifetimes.
Other vulnerabilities in nerves_hub_web
See all- CVE-2026-120999High
An Improper Authentication vulnerability in Google sign-in and email confirmation in nerves_hub_web allows an attacker who registers another person's email address to share that person's account once they sign in. The system signs a Google user into any account with the same email without the owner proving ownership.
- CVE-2026-120730High
An Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in the device API, device forms, signing key and product forms, and JITP settings in nerves_hub_web allows an authenticated user who manages devices in one organization to write into other organizations via submitted org_id, product_id, and deployment_id fields. A device placed on another organization's deployment group is sent that organization's firmware with a download URL.
- CVE-2026-120295High
An Incorrect Authorization vulnerability in the devices page bulk move in nerves_hub_web allows an authenticated user with the manage role in one organization and only the view role in another to move devices into the second organization's product. A moved device keeps its key and certificate and joins the target organization's deployment groups.
- CVE-2026-120286Medium
Missing Authorization vulnerability in the device and deployment group pages in nerves-hub nerves_hub_web allows an authenticated organization member with the view role to change devices and deployment groups via LiveView events reserved for the manage role. The event handlers carry out changes without calling authorized!/2, and the pages render the controls to every member. A view member can add or delete certificates, change tags, manual location, deployment group membership, and start, retry or delete firmware delta builds.
- CVE-2026-119446Critical
A Session Fixation vulnerability in the CLI login flow in nerves_hub_web allows an unauthenticated attacker to obtain an API token for another user's account via a crafted login link. The confirmation code is only displayed and never compared, so it cannot prove that the confirming person is the one who started the login.
Original NVD description (English source)
Improper Session Invalidation vulnerability in the dashboard pages, device console and local shell channels in nerves-hub nerves_hub_web allows an organization member who is removed or given a lower role to keep acting at their old role through anything they had open at the time. The dashboard reads the member's role once when a page mounts, in the assign_org_to_scope hook of NervesHubWeb.Auth, and the console, local shell and device event stream channels check membership once at join. Removing a member or changing their role tells none of them, so open pages keep carrying out actions and open consoles keep running commands on the device until the page reloads or the socket disconnects. The dashboard also opens consoles over NervesHubWeb.UserSocket with a token that holds only the user's id, is accepted for 24 hours, and is not revoked by signing out, which disconnects only the session's LiveViews. Whoever holds a token taken from a page can open consoles as that user, within the user's current membership, until it expires. This issue affects nerves_hub: from 1.0.0 before 2.5.3.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS