Skip to content
OpenAdvisories

Vendor

hexpm

19 known vulnerabilities.

Products

hex 10 hexpm 8 hex_core 4 hex.pm 3
All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Critical 9.5
    CVE-2026-21622

    Password Reset Tokens Do Not Expire

    Insufficient Session Expiration vulnerability in hexpm hexpm/hexpm ('Elixir.Hexpm.Accounts.PasswordReset' module) allows Account Takeover. Password reset tokens generated via the "Reset your password" flow do not expire. When a user requests a password reset,…

    hexpm hexpm hex.pm