CVE-2026-120999 | nerves-hub nerves_hub_web up to 2.5.2 Account Linking/Session Confirmation improper authentication

November 10, 2026 Yanac

A vulnerability classified as critical was found in nerves-hub nerves_hub_web up to 2.5.2. This affects the function NervesHub.Accounts.update_or_create_user_from_ueberauth/NervesHubWeb.SessionController.confirm of the component Account Linking/Session Confirmation. Such manipulation leads to improper authentication.

This vulnerability is uniquely identified as CVE-2026-120999. The attack can be launched remotely. No exploit exists.

Upgrading the affected component is advised.VulDB Recent EntriesRead More