CVE-2026-75554

Executive Summary

CVE-2026-75554 is an insufficient session expiration vulnerability in hexpm, the package manager for the Elixir programming language ecosystem. The flaw allows a user removed from an organization to continue reading that organization's private packages indefinitely, bounded only by a 30-day OAuth refresh token lifetime rather than the intended 30-minute access token lifetime. All hex.pm deployments between 2025-10-10 and 2026-08-23 are affected. No patch is currently available from any tracked source, and no public exploit code or proof-of-concept has been identified at the time of writing.

Technical Analysis

The vulnerability resides in the OAuth token refresh grant mechanism of hexpm, specifically in the handling of repository and documentation scopes. The NVD description identifies the flaw in expand_repositories_scope/3 located in lib/hexpm/permissions.ex. This function is responsible for expanding repository scopes during authorization flows.

The core issue is a scope expansion bypass: expand_repositories_scope/3 only rewrites the literal repositories scope. When an explicitly granted repository:<org> or docs:<org> scope is presented, the function passes it through unchanged. This is significant because the refresh grant mechanism derives a new token from the stored granted_scopes value. Since the stored value contains the expanded form of the scope (i.e., the specific organization-level scope), every token refresh reproduces the organization scope without revisiting membership.

The architectural consequence is twofold:

1. Token Re-derivation Without Revalidation: The refresh grant re-derives access tokens from stored scopes without querying the organization membership database. The access control decision is made at token issuance time, not at request time.

2. CDN Edge Authorization Reliance: Both CDN edges (Content Delivery Network edge nodes) authorize repository access based on the token claim alone. They do not perform database lookups to verify ongoing organization membership. This means the authorization decision is entirely delegated to the token's embedded claims.

The net effect is that when an account is removed from an organization, the revoked user can continue refreshing their token and retain full read access to private packages. The lifetime of this unauthorized access is governed by the 30-day refresh token lifetime rather than the intended 30-minute access token lifetime. The refresh token itself never invalidates upon organization membership changes because the revocation event does not trigger any token invalidation or scope re-evaluation.

The attack surface is the OAuth refresh grant endpoint, which is reachable over the network. The privilege required to exploit this is a valid refresh token with organization-level scopes — an attacker would need to have previously been a legitimate member of the organization.

Exploitation Scenarios

Reconnaissance and Target Identification: The attacker is an insider or former insider — specifically a user who was previously granted access to an organization's private packages on hex.pm. They would have legitimate credentials and a valid OAuth refresh token obtained during their prior membership. No external reconnaissance is required since the attacker already possesses valid authentication material.

Flaw Trigger: The attacker triggers the flaw by calling the OAuth token refresh grant endpoint with their previously obtained refresh token. Because the refresh grant re-derives a new token from the stored granted_scopes (which includes the expanded repository:<org> or docs:<org> scope), and because expand_repositories_scope/3 fails to rewrite these explicitly granted scopes during the refresh flow, the new token will include the same organization-level access claims.

Execution Method: The attack is execution via the OAuth protocol itself — no payload injection is required. The attacker simply presents the refresh token and receives a new access token containing the expanded organization scopes. The CDN edge authorizes access based on the token claims without checking database membership state.

Post-Exploitation Impact: The attacker retains read access to all private packages within the organization they were removed from. This access persists for the duration of the 30-day refresh token lifetime, with each refresh extending the session. The attacker can download package source code, documentation, and potentially discover secrets or intellectual property embedded in package contents.

No public PoC is available; this attack chain is inferred from the vulnerability class and the technical details provided in the NVD description.

Impact Assessment

Business Impact: This vulnerability enables unauthorized read access to private package repositories in the Elixir ecosystem. Organizations using hex.pm for private package distribution face:

• Intellectual Property Theft: Private package source code and documentation are exposed to former members.
• Data Confidentiality Breach: Sensitive configuration, proprietary algorithms, or internal dependencies can be exfiltrated.
• Competitive Disadvantage: Compromised private packages could leak trade secrets.

Affected Systems: All hex.pm instances operating between 2025-10-10 and 2026-08-23. This includes both the public hex.pm service at hex.pm (if still running the affected version) and any self-hosted or enterprise deployments of the hexpm software.

Blast Radius: The vulnerability affects organizations that use hex.pm private repositories. The degree of exposure depends on: (1) the number of users removed from organizations during the affected period, (2) the sensitivity of private packages, and (3) whether the removed user's tokens have been explicitly revoked independently of membership changes.

CVSS Assessment: CVSS 3.1 vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N — High privilege required (valid refresh token), but no user interaction, network attack vector, and high confidentiality impact. The completeness of the private package exposure (entire org scope) justifies the high confidentiality subscore despite the privilege requirement.

Detection Guidance

Sigma Rule

title: Hexpm OAuth Refresh Token Reuse After Membership Revocation
id: 83927a3e-5d6a-4fab-9c51-0e1ab0b70d43
status: experimental
description: Detects OAuth token refresh requests from users whose organization membership has been revoked, indicating potential exploitation of CVE-2026-75554
author: valtersit.com Threat Intelligence
date: 2026/08/25
logsource:
    category: application
    product: hexpm
detection:
    selection:
        event.module: oauth
        event.action: token_refresh
        grant_type: refresh_token
        scope|contains|all:
            - 'repository:'
            - 'docs:'
    filter_known:
        user.status: active
    condition: selection and not filter_known
falsepositives:
    - Legitimate refresh before revocation takes effect (race condition)
    - Misconfigured membership status in directory service
level: high
tags:
    - attack.t1078
    - cve.2026-75554
    - cwe.613

YARA Rule

rule Hexpm_Scope_Expansion_Bypass_Signatures
{
    meta:
        author = "valtersit.com Threat Intelligence"
        date = "2026-08-25"
        description = "Detects code patterns associated with CVE-2026-75554 scope expansion bypass in hexpm permissions module"
        cve = "CVE-2026-75554"
        cwe = "CWE-613"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-75554"
    strings:
        $fn_expand = "expand_repositories_scope" ascii
        $fn_scope = "granted_scopes" ascii
        $repo_scope = "repository:" ascii
        $docs_scope = "docs:" ascii
        $refresh = "refresh_token" ascii
        $perm_file = "lib/hexpm/permissions.ex" ascii
    condition:
        uint16(0) == 0x3F21 or ($fn_expand and $perm_file) or
        ($fn_scope and ($repo_scope or $docs_scope) and $refresh)
}

Suricata IDS Rule

alert http any any -> any any (msg:"HEXPM CVE-2026-75554 OAuth Refresh Token Scope Expansion"; flow:to_server,established; content:"POST"; http_method; content:"/auth/token"; http_uri; content:"grant_type=refresh_token"; http_client_body; content:"scope"; http_client_body; pcre:"/scope=(?:repository|docs):[\w.-]+/i"; metadata:cve CVE-2026-75554; classtype:attempted-user; sid:95001234; rev:1;)

Elastic Detection

query: |
  event.module : "hexpm" AND event.action : "token_refresh" AND
  (scope : "repository:*" OR scope : "docs:*") AND
  NOT user.status : "active"

Note on Elastic EQL: EQL does not natively support wildcard string matching on all field types as of the standard detection engine. The above lucene-style query is recommended for use in Elasticsearch Watcher or Elastic Security Rule queries.

Splunk SPL Query

index=hexpm sourcetype=hexpm:oauth
| where action="token_refresh" AND (scope LIKE "repository:%" OR scope LIKE "docs:%")
| search NOT user_status="active"
| stats count by user, organization, src_ip, _time
| where count > 1
| table _time, user, organization, src_ip, count

Wazuh OSSEC Rule

<group name="hexpm,">
  <rule id="100234" level="12">
    <decoded_as>json</decoded_as>
    <field name="event.module">^oauth$</field>
    <field name="event.action">^token_refresh$</field>
    <field name="scope">repository:|docs:</field>
    <field name="user.status">!^active$</field>
    <description>Hexpm CVE-2026-75554 OAuth refresh token scope reuse by inactive user</description>
    <mitre><id>T1078</id></mitre>
    <group>authentication,session,hexpm,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Status: Patch confidence 0/4 — UNPATCHED. No patch evidence from any tracked source. Vendor fix not yet available. There is a 0/4 confidence that a patch exists.

Immediate Mitigations (within 24 hours):

1. Manually revoke all tokens upon member removal: When removing a user from an organization, proactively expire all OAuth refresh tokens and access tokens for that account in addition to removing membership.
2. Shorten refresh token lifetime: If configurable in the deployment, reduce refresh token lifetime from 30 days to a shorter duration to bound exposure.
3. Monitor for anomalous refresh patterns: Deploy the detection rules above to identify refresh activity from users whose membership has been revoked.
4. Audit recent member removals: Review all organization membership removals that occurred since 2025-10-10 and verify that the affected users' tokens have been explicitly revoked.

Patch/Upgrade Steps: No patch is currently available. Monitor vendor communications from hexpm for an updated release after 2026-08-24. When available, upgrade to the fixed hexpm version immediately.

Long-Term Hardening:

1. Implement token invalidation on membership change: Ensure the authorization infrastructure subscribes to membership change events and invalidates tokens accordingly.
2. Validate scopes at authorization time: Modify the authorization architecture so CDN edges query the database for membership status rather than relying solely on token claims.
3. Fix scope expansion logic: Correct expand_repositories_scope/3 in lib/hexpm/permissions.ex to rewrite all explicitly granted organization-level scopes (not just the literal repositories scope) and to re-validate against current membership.
4. Implement defense in depth: Add organization membership checks as a middleware layer in the token refresh path.
5. Periodic security audits: Review OAuth scope handling and session expiration logic as part of regular security assessments.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-75554 — Official CVE record with NVD description and CWE classification.
2. CWE-613 Insufficient Session Expiration: https://cwe.mitre.org/data/definitions/613.html — Common Weakness Enumeration reference for the vulnerability class.
3. Hex.pm Official Website: https://hex.pm — The affected package management service; monitor for vendor advisories.
4. Hexpm GitHub Repository: https://github.com/hexpm/hexpm — Source repository for the affected software; monitor for patch commits.
5. MITRE ATT&CK T1078 — Valid Accounts: https://attack.mitre.org/techniques/T1078/ — Technique taxonomy for abuse of valid credentials.

Known Threat Actor Campaigns: No known threat actor campaigns or exploit-in-the-wild evidence has been identified for CVE-2026-75554 at the time of writing. No CISA KEV listing exists. No public PoC or exploit code is available. The vulnerability is best described as a latent insider-threat risk that could be exploited by former organization members.