Skip to content
Threat Feed
Subscribe

Product

Nebula-Mesh (<= 0.3.7)

1 brief RSS
high advisory

Nebula-Mesh Stores Operator Session Tokens in Plaintext, Enabling Session Hijacking (CVE-2026-53603)

Operator session tokens in ForgeKeep's nebula-mesh application are stored in plaintext within the database, allowing an attacker who gains read access to the database to retrieve active session tokens and hijack operator sessions, bypassing further authentication.

nebula-mesh vulnerability session-hijacking database plaintext credential-exposure
1t