CVE-2026-75554 hexpm CVE debrief

Who should care

Organizations and users of hexpm, particularly those managing user access and privileges within organizations, should be aware of this vulnerability and take necessary precautions to mitigate the risk. This includes verifying user memberships and session expirations in hexpm configurations, ensuring proper management of user access and privileges, and monitoring for unusual activity related to OAuth token refresh grants. Additionally, security teams and vulnerability management teams should review the CVE record and assess the potential impact on their systems and assets. Operators of hexpm instances should also review their configurations and ensure that they are up-to-date with the latest security patches and recommendations. Furthermore, platform administrators and security personnel should be aware of the potential risks associated with insufficient session expiration and take steps to mitigate them. Lastly, developers and maintainers of hexpm should review the code and ensure that the fix is properly implemented and tested. IT teams and incident response teams should also be prepared to respond to potential security incidents related to this vulnerability. Compliance teams and risk management teams should also review the CVE record and assess the potential impact on their organization's risk profile and compliance posture. Lastly, users of hexpm should be aware of the potential risks and take necessary precautions to protect their packages and user access. Overall, a wide range of stakeholders, including developers, administrators, security personnel, and users, should be aware of this vulnerability and take necessary precautions to mitigate the risk. The CVE-2026-75554 vulnerability affects hex.pm from 2025-10-10 before 2026-08-24, and users should ensure they are running a version that is not vulnerable. Users should also review the official CVE Program record and the NIST NVD detail page for more information on the vulnerability and its impact. Additionally, users should verify their configurations and ensure that user memberships are properly managed to mitigate the risk of insufficient session expiration. Users should also monitor for unusual activity.

Technical summary

The CVE-2026-75554 vulnerability in hexpm's OAuth token refresh grant allows a user removed from an organization to keep reading its private packages due to insufficient session expiration. The issue arises from the refresh grant re-deriving a new token from stored granted scopes, which reproduces the organization scope without revisiting membership. This affects hex.pm from 2025-10-10 before 2026-08-24.

Defensive priority

Organizations using hexpm should verify their configurations and ensure that user memberships are properly managed to mitigate the risk of insufficient session expiration.

Recommended defensive actions

• Verify user memberships and session expirations in hexpm configurations.
• Ensure proper management of user access and privileges.
• Monitor for unusual activity related to OAuth token refresh grants.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE-2026-75554 issue arises from the OAuth token refresh grant in hexpm, where an insufficient session expiration vulnerability allows a user removed from an organization to retain read access to its private packages. This occurs because the refresh grant re-derives a new token from stored granted scopes, reproducing the organization scope without revisiting membership. The issue affects hex.pm from 2025-10-10 before 2026-08-24.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.