NervesHub: Session fixation in CLI login flow (CVE-2026-119446)

CVE-2026-119446 is a session fixation vulnerability in the nerves_hub_web CLI login flow. An unauthenticated attacker can initiate a session request via an API endpoint, generating a polling token and a confirmation URL. If a legitimate, authenticated user is tricked into navigating to this URL and confirming the request, the application generates and associates an API token with the victim's account, which the attacker subsequently retrieves by polling the session endpoint. The vulnerability stems from a lack of validation between the initiator of the login request and the user confirming the session.

Attack Chain

1. Attacker sends a POST request to /api/auth/cli_session to initiate a CLI login.
2. The application returns a polling token, a confirmation URL, and a confirmation code to the attacker.
3. Attacker uses social engineering to trick a signed-in user into visiting the confirmation URL.
4. The victim visits the URL and clicks "Confirm" in the web interface.
5. The application (via NervesHub.Accounts.verify_cli_session_token/2) creates an API token for the victim's account.
6. The application stores this token on the session state.
7. Attacker polls GET /api/auth/cli_session/<token> to retrieve the victim's API token.

Recommendation

• Upgrade NervesHub nerves_hub_web to version 2.5.3 or later immediately to patch CVE-2026-119446.
• Implement monitoring for abnormal API access patterns originating from CLI session endpoints.