{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/nerveshub/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:nerves-hub:nerves_hub_web:2.5.0:*:*:*:*:*:*:*","cpe:2.3:a:nerves-hub:nerves_hub_web:2.5.1:*:*:*:*:*:*:*","cpe:2.3:a:nerves-hub:nerves_hub_web:2.5.2:*:*:*:*:*:*:*"],"_cs_cves":[{"id":"CVE-2026-119446"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["nerves_hub_web (2.5.0-2.5.2)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["NervesHub"],"content_html":"\u003cp\u003eCVE-2026-119446 is a session fixation vulnerability in the nerves_hub_web CLI login flow. An unauthenticated attacker can initiate a session request via an API endpoint, generating a polling token and a confirmation URL. If a legitimate, authenticated user is tricked into navigating to this URL and confirming the request, the application generates and associates an API token with the victim's account, which the attacker subsequently retrieves by polling the session endpoint. The vulnerability stems from a lack of validation between the initiator of the login request and the user confirming the session.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker sends a POST request to /api/auth/cli_session to initiate a CLI login.\u003c/li\u003e\n\u003cli\u003eThe application returns a polling token, a confirmation URL, and a confirmation code to the attacker.\u003c/li\u003e\n\u003cli\u003eAttacker uses social engineering to trick a signed-in user into visiting the confirmation URL.\u003c/li\u003e\n\u003cli\u003eThe victim visits the URL and clicks \u0026quot;Confirm\u0026quot; in the web interface.\u003c/li\u003e\n\u003cli\u003eThe application (via NervesHub.Accounts.verify_cli_session_token/2) creates an API token for the victim's account.\u003c/li\u003e\n\u003cli\u003eThe application stores this token on the session state.\u003c/li\u003e\n\u003cli\u003eAttacker polls GET /api/auth/cli_session/\u0026lt;token\u0026gt; to retrieve the victim's API token.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade NervesHub nerves_hub_web to version 2.5.3 or later immediately to patch CVE-2026-119446.\u003c/li\u003e\n\u003cli\u003eImplement monitoring for abnormal API access patterns originating from CLI session endpoints.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-10T13:46:48Z","date_published":"2026-11-10T13:46:48Z","id":"https://feed.craftedsignal.io/briefs/2026-11-cve-2026-119446/","summary":"NervesHub nerves_hub_web versions 2.5.0 to 2.5.2 contain a session fixation vulnerability in the CLI login flow, allowing unauthenticated attackers to hijack API tokens if a signed-in user is coerced into confirming a crafted login request.","title":"NervesHub: Session fixation in CLI login flow (CVE-2026-119446)","url":"https://feed.craftedsignal.io/briefs/2026-11-cve-2026-119446/"}],"language":"en","title":"CraftedSignal Threat Feed - NervesHub","version":"https://jsonfeed.org/version/1.1"}