Security readout for executives and security teams
Plain-English summary
Hex.pm’s password reset flow could create links that never expire. If an old, unused reset email was exposed in a mailbox breach or archive leak, someone could use that link later to take over the account. The sources rate this as critical, but they do not state that exploitation is currently occurring.
Executive priority
Treat as urgent for any organization running affected hexpm/hexpm code or responsible for Hex.pm account security. The business risk is account takeover from old leaked email data, not just current mailbox compromise.
Technical view
CVE-2026-21622 is CWE-613 insufficient session expiration in hexpm/hexpm, specifically Elixir.Hexpm.Accounts.PasswordReset can_reset?/3. Reset tokens from the password reset flow remained valid indefinitely until used. Affected code is from commit 617e44c71f1dd9043870205f371d375c5c4d886d before bb0e42091995945deef10556f58d046a52eb7884.
Likely exposure
Exposure is most relevant to operators of affected hexpm/hexpm deployments and the listed hex.pm service entry. Risk is higher where users’ historical email archives may have been leaked and contain unused password reset messages.
Exploitation context
The attacker would need an unused historical password reset email, such as from a breached mailbox archive. The sources do not indicate CISA KEV listing or confirmed active exploitation.
Researcher notes
The vulnerability hinges on indefinite validity of unused reset tokens. Public sources identify affected files, routine, commit range, CVSS 4.0 score 9.5, and patch commit. They do not provide evidence of exploitation in the wild.
Mitigation direction
- Apply the vendor patch at commit bb0e42091995945deef10556f58d046a52eb7884 or a release containing it.
- Review the GitHub advisory and CNA notice for current vendor guidance.
- Identify whether any deployed hexpm/hexpm code predates the patched commit.
- Consider user communication or token hygiene only if supported by vendor guidance.
Validation and detection
- Confirm deployed code includes commit bb0e42091995945deef10556f58d046a52eb7884 or later.
- Review PasswordReset can_reset?/3 behavior for time-based expiration enforcement.
- Check incident records for exposed mailbox archives containing reset emails.
- Monitor vendor advisory pages for updated remediation instructions.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-613: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCredential and access behavior lookup
The CVE wording references authentication or credential exposure, so valid-account and credential-access review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2026-21622 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.5 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L——Primary CVE scoreVulnerability scoring details
Base CVSS 4.0 score
9.5CriticalVector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/hexpm/hexpm/security/advisories/GHSA-6r94-pvwf-mxqmCVE reference · vendor-advisory, related
- https://cna.erlef.org/cves/CVE-2026-21622.htmlCVE reference · related
- https://osv.dev/vulnerability/EEF-CVE-2026-21622CVE reference · related
- https://github.com/hexpm/hexpm/commit/bb0e42091995945deef10556f58d046a52eb7884CVE reference · patch
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Insufficient Session Expiration
Insufficient Session Expiration represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.