CVE-2026-75542: hexpm OAuth Authorization Bypass Vulnerability

CVE-2026-75542 Overview

CVE-2026-75542 is an Incorrect Authorization vulnerability [CWE-863] in the OAuth token endpoint of hexpm, the package manager for the Erlang ecosystem. An API key holding the repositories permission can request an OAuth token scoped to any organization's private repository. The token endpoint accepts scopes beginning with repository: without resolving the organization name against the authenticated principal. CDN edges then authorize repository access from the token claim alone, granting read access to another organization's private packages until the token expires. The issue affects hex.pm from 2025-10-18 through 2026-08-24.

Critical Impact
Any holder of an API key with the repositories permission can mint OAuth tokens that grant read access to any other organization's private packages hosted on hex.pm.

Affected Products

hexpm/hexpm (hex.pm service)
API keys with the repositories permission
Downstream Elixir and Erlang projects depending on private Hex packages

Discovery Timeline

2026-08-24 - CVE-2026-75542 published to NVD
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-75542

Vulnerability Analysis

The vulnerability resides in validate_scopes_against_key/2 inside lib/hexpm_web/controllers/api/oauth_controller.ex. During an OAuth client_credentials grant, the function admits any requested scope whose string begins with repository:, provided the API key carries the repositories permission. The organization name in the scope is never verified against the principal that owns the key.

The helper expand_repositories_scope/3 only rewrites the literal repositories scope. An explicit scope such as repository:<target-org> passes through unchanged into the minted token. Both CDN edges then authorize package downloads based solely on the token claim without additional database lookups, producing valid read access to the target organization's private packages until expiration.

Root Cause

The root cause is missing cross-tenant authorization on scope resolution. The token issuer trusts the client-supplied scope string once a coarse repositories permission bit is present. There is no check that the requested repository:<name> corresponds to an organization the principal can access, violating principle of least privilege enforcement.

Attack Vector

An authenticated attacker with any API key holding the repositories permission sends a token request to the OAuth endpoint including scope=repository:<victim-org>. The server issues an access token containing the requested scope. The attacker then pulls private packages through the CDN using that token. No user interaction is required, and the attack occurs over the network at low complexity with low privileges.

text

// Security patch in lib/hexpm/oauth/tokens.ex
// Resolve `repositories` scopes against the principal's own access
  end

  defp create_for_org(org, client_id, scopes, grant_type, grant_reference, opts) do
+    scopes = Enum.reject(scopes, &foreign_organization_scope?(&1, org))
    expires_in = Keyword.get(opts, :expires_in, @default_expires_in)
    expires_at = DateTime.add(DateTime.utc_now(), expires_in, :second)

Source: hexpm commit bf0fb9d

text

// Security patch in lib/hexpm/accounts/organization.ex
// Deny permission checks against foreign organizations
    {:ok, organization}
  end

+  def verify_permissions(%Organization{}, _domain, _resource), do: :error
+
  def billing_active?(%Organization{billing_active: active} = organization) do
    active or trialing?(organization)
  end

Source: hexpm commit bf0fb9d

Detection Methods for CVE-2026-75542

Indicators of Compromise

OAuth token requests to hex.pm containing scope=repository:<name> where <name> is an organization the requesting API key does not belong to.
Package downloads from CDN edges using tokens whose repository claim does not match the token principal's organization membership.
API key usage patterns showing token issuance immediately followed by cross-organization repository reads.

Detection Strategies

Correlate OAuth client_credentials token issuance events with the organization membership of the API key owner, and alert when scopes reference foreign organizations.
Baseline private package pull activity per organization and flag anomalous access originating from tokens minted by unrelated API keys.
Review Hex audit logs for tokens issued between 2025-10-18 and 2026-08-24 whose scopes reference organizations outside the principal's access.

Monitoring Recommendations

Ingest hex.pm audit and CDN access logs into a centralized SIEM to correlate token issuance with package retrieval by organization.
Monitor for unusual spikes in private package downloads across organizations that do not typically consume each other's dependencies.
Track outbound network activity from build servers and CI runners for connections to repo.hex.pm using unexpected authentication tokens.

How to Mitigate CVE-2026-75542

Immediate Actions Required

Rotate all hex.pm API keys that carry the repositories permission, especially those used in CI and shared automation.
Review OAuth token issuance and package download logs from 2025-10-18 through 2026-08-24 for cross-organization access.
Audit private package integrity for organizations that may have been exposed, and rotate any secrets embedded in private packages.

Patch Information

The fix is delivered in commit bf0fb9d208f0acfabf7a2f7467c8231659e322a8, which rejects scopes referencing organizations outside the principal's access and returns :error from verify_permissions/3 for foreign organizations. See the GitHub Security Advisory GHSA-rfx8-w654-8cpr and the CNA advisory for CVE-2026-75542 for full remediation details.

Workarounds

Remove the repositories permission from API keys that do not strictly require private package access.
Restrict OAuth client_credentials usage to trusted automation and revoke long-lived tokens minted during the vulnerable window.
Enforce scoped API keys per organization rather than broad multi-tenant keys.

bash

# Rotate a hex.pm API key and re-authenticate the local client
mix hex.user key generate --key-name ci-rotated-2026-08
mix hex.user key revoke --key-name ci-legacy
mix hex.user auth