Xerj Console API Auth Bypass Enables Persistence
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
Unpatched flaw in Xerj's console API lets attackers mint successor tokens that survive revocation, bypassing passkey/MFA requirements.
CERT/CC has published VU#645818 describing CVE-2026-97406, an authentication bypass in Xerj, an open-source search and indexing engine built for AI agents using the Elasticsearch API. The flaw arises because Xerj collapses both browser sessions and API bearer tokens into a single generic AuthSession object, and its token-creation endpoint fails to verify whether the underlying session was actually established via a passkey-backed authentication flow as required by the documented security contract.
An attacker who obtains or intercepts a valid Xerj API token can call the token creation endpoint directly to mint an independent successor token carrying the same privileges as the original, without ever completing passkey authentication. Because Xerj lacks hierarchical revocation, revoking the compromised parent token does not invalidate any descendant tokens it spawned, giving the attacker durable access. If the compromised token belongs to an account owner, the successor token retains full administrative rights, enabling the attacker to issue a new account invitation, redeem it themselves, and enroll an attacker-controlled passkey — granting permanent administrative control over the Xerj instance and its data indices.
No evidence of in-the-wild exploitation is noted. The vendor could not be reached to coordinate disclosure and no patch is currently available. Defenders running Xerj should monitor the project's GitHub repository for a fix, audit for unexpected token-creation events or newly enrolled passkeys/invitations, and treat any exposed or leaked Xerj API token as a potential full-compromise event requiring full account/credential rotation rather than simple token revocation.
Mentioned in this report
Source reporting: https://kb.cert.org/vuls/id/645818
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs