Vendor
NervesHub nerves_hub_web versions 2.5.0 to 2.5.2 contain a session fixation vulnerability in the CLI login flow, allowing unauthenticated attackers to hijack API tokens if a signed-in user is coerced into confirming a crafted login request.