Cpe:2.3:a:nerves-Hub:nerves_hub_web:2.5.2:*:*:*:*:*:*:*

NervesHub nerves_hub_web versions 2.5.0 to 2.5.2 contain a session fixation vulnerability in the CLI login flow, allowing unauthenticated attackers to hijack API tokens if a signed-in user is coerced into confirming a crafted login request.