CVE-2026-120997 (GCVE-0-2026-120997)
Vulnerability from cvelistv5 – Published: 2026-11-10 10:43 – Updated: 2026-11-10 10:43
VLAI
EPSS
VEX
Title
Improper session invalidation keeps removed or demoted members' open pages and device consoles working at their old role
Summary
Improper Session Invalidation vulnerability in the dashboard pages, device console and local shell channels in nerves-hub nerves_hub_web allows an organization member who is removed or given a lower role to keep acting at their old role through anything they had open at the time. The dashboard reads the member's role once when a page mounts, in the assign_org_to_scope hook of NervesHubWeb.Auth, and the console, local shell and device event stream channels check membership once at join. Removing a member or changing their role tells none of them, so open pages keep carrying out actions and open consoles keep running commands on the device until the page reloads or the socket disconnects.
The dashboard also opens consoles over NervesHubWeb.UserSocket with a token that holds only the user's id, is accepted for 24 hours, and is not revoked by signing out, which disconnects only the session's LiveViews. Whoever holds a token taken from a page can open consoles as that user, within the user's current membership, until it expires.
This issue affects nerves_hub: from 1.0.0 before 2.5.3.
Severity
CWE
Assigner
EEF
CNA
References
5 references
| URL | Tags |
|---|---|
| https://github.com/nerves-hub/nerves_hub_web/secu… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-120997.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-120997 | related |
| https://github.com/nerves-hub/nerves_hub_web/comm… | related |
| https://github.com/nerves-hub/nerves_hub_web/comm… | patch |
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| nerves-hub | nerves_hub_web |
Affected:
1.0.0 , < 2.5.3
(other)
cpe:2.3:a:nerves-hub:nerves_hub_web:*:*:*:*:*:*:*:* |
|
| nerves-hub | nerves_hub_web |
Affected:
1.0.0 , < 2.5.3
(semver)
cpe:2.3:a:nerves-hub:nerves_hub_web:*:*:*:*:*:*:*:* |
|
| nerves-hub | nerves_hub_web |
Affected:
b5d2438677f79d10e91aeef20a7b5cd8cca0d63c , < a96497ddd4d24ab1847f7685e255bf96fd87b85b
(git)
cpe:2.3:a:nerves-hub:nerves_hub_web:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://ghcr.io",
"cpes": [
"cpe:2.3:a:nerves-hub:nerves_hub_web:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.NervesHubWeb.UserSocket\u0027",
"\u0027Elixir.NervesHubWeb.UserConsoleChannel\u0027",
"\u0027Elixir.NervesHubWeb.UserLocalShellChannel\u0027",
"\u0027Elixir.NervesHubWeb.DeviceEventsStreamChannel\u0027",
"\u0027Elixir.NervesHubWeb.Auth\u0027",
"\u0027Elixir.NervesHub.Accounts\u0027"
],
"packageName": "nerves-hub/nerves-hub",
"packageURL": "pkg:oci/nerves-hub?repository_url=ghcr.io%2Fnerves-hub",
"product": "nerves_hub_web",
"programFiles": [
"lib/nerves_hub_web/channels/user_socket.ex",
"lib/nerves_hub_web/channels/user_console_channel.ex",
"lib/nerves_hub_web/channels/user_local_shell_channel.ex",
"lib/nerves_hub_web/channels/device_events_stream_channel.ex",
"lib/nerves_hub_web/auth.ex",
"lib/nerves_hub/accounts.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.NervesHubWeb.UserSocket\u0027:connect/2"
},
{
"name": "\u0027Elixir.NervesHubWeb.UserSocket\u0027:id/1"
},
{
"name": "\u0027Elixir.NervesHubWeb.UserConsoleChannel\u0027:join/3"
},
{
"name": "\u0027Elixir.NervesHubWeb.UserLocalShellChannel\u0027:join/3"
},
{
"name": "\u0027Elixir.NervesHubWeb.DeviceEventsStreamChannel\u0027:join/3"
},
{
"name": "\u0027Elixir.NervesHubWeb.Auth\u0027:on_mount/4"
},
{
"name": "\u0027Elixir.NervesHubWeb.Auth\u0027:log_out_user/1"
},
{
"name": "\u0027Elixir.NervesHub.Accounts\u0027:soft_delete_org_user/1"
},
{
"name": "\u0027Elixir.NervesHub.Accounts\u0027:change_org_user_role/2"
}
],
"vendor": "nerves-hub",
"versions": [
{
"lessThan": "2.5.3",
"status": "affected",
"version": "1.0.0",
"versionType": "other"
}
]
},
{
"cpes": [
"cpe:2.3:a:nerves-hub:nerves_hub_web:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.NervesHubWeb.UserSocket\u0027",
"\u0027Elixir.NervesHubWeb.UserConsoleChannel\u0027",
"\u0027Elixir.NervesHubWeb.UserLocalShellChannel\u0027",
"\u0027Elixir.NervesHubWeb.DeviceEventsStreamChannel\u0027",
"\u0027Elixir.NervesHubWeb.Auth\u0027",
"\u0027Elixir.NervesHub.Accounts\u0027"
],
"packageName": "nerves_hub",
"packageURL": "pkg:otp/nerves_hub?repository_url=https:%2F%2Fgithub.com%2Fnerves-hub%2Fnerves_hub_web\u0026vcs_url=git%20https:%2F%2Fgithub.com%2Fnerves-hub%2Fnerves_hub_web.git",
"product": "nerves_hub_web",
"programFiles": [
"lib/nerves_hub_web/channels/user_socket.ex",
"lib/nerves_hub_web/channels/user_console_channel.ex",
"lib/nerves_hub_web/channels/user_local_shell_channel.ex",
"lib/nerves_hub_web/channels/device_events_stream_channel.ex",
"lib/nerves_hub_web/auth.ex",
"lib/nerves_hub/accounts.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.NervesHubWeb.UserSocket\u0027:connect/2"
},
{
"name": "\u0027Elixir.NervesHubWeb.UserSocket\u0027:id/1"
},
{
"name": "\u0027Elixir.NervesHubWeb.UserConsoleChannel\u0027:join/3"
},
{
"name": "\u0027Elixir.NervesHubWeb.UserLocalShellChannel\u0027:join/3"
},
{
"name": "\u0027Elixir.NervesHubWeb.DeviceEventsStreamChannel\u0027:join/3"
},
{
"name": "\u0027Elixir.NervesHubWeb.Auth\u0027:on_mount/4"
},
{
"name": "\u0027Elixir.NervesHubWeb.Auth\u0027:log_out_user/1"
},
{
"name": "\u0027Elixir.NervesHub.Accounts\u0027:soft_delete_org_user/1"
},
{
"name": "\u0027Elixir.NervesHub.Accounts\u0027:change_org_user_role/2"
}
],
"repo": "https://github.com/nerves-hub/nerves_hub_web",
"vendor": "nerves-hub",
"versions": [
{
"lessThan": "2.5.3",
"status": "affected",
"version": "1.0.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:nerves-hub:nerves_hub_web:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.NervesHubWeb.UserSocket\u0027",
"\u0027Elixir.NervesHubWeb.UserConsoleChannel\u0027",
"\u0027Elixir.NervesHubWeb.UserLocalShellChannel\u0027",
"\u0027Elixir.NervesHubWeb.DeviceEventsStreamChannel\u0027",
"\u0027Elixir.NervesHubWeb.Auth\u0027",
"\u0027Elixir.NervesHub.Accounts\u0027"
],
"packageName": "nerves-hub/nerves_hub_web",
"packageURL": "pkg:github/nerves-hub/nerves_hub_web",
"product": "nerves_hub_web",
"programFiles": [
"lib/nerves_hub_web/channels/user_socket.ex",
"lib/nerves_hub_web/channels/user_console_channel.ex",
"lib/nerves_hub_web/channels/user_local_shell_channel.ex",
"lib/nerves_hub_web/channels/device_events_stream_channel.ex",
"lib/nerves_hub_web/auth.ex",
"lib/nerves_hub/accounts.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.NervesHubWeb.UserSocket\u0027:connect/2"
},
{
"name": "\u0027Elixir.NervesHubWeb.UserSocket\u0027:id/1"
},
{
"name": "\u0027Elixir.NervesHubWeb.UserConsoleChannel\u0027:join/3"
},
{
"name": "\u0027Elixir.NervesHubWeb.UserLocalShellChannel\u0027:join/3"
},
{
"name": "\u0027Elixir.NervesHubWeb.DeviceEventsStreamChannel\u0027:join/3"
},
{
"name": "\u0027Elixir.NervesHubWeb.Auth\u0027:on_mount/4"
},
{
"name": "\u0027Elixir.NervesHubWeb.Auth\u0027:log_out_user/1"
},
{
"name": "\u0027Elixir.NervesHub.Accounts\u0027:soft_delete_org_user/1"
},
{
"name": "\u0027Elixir.NervesHub.Accounts\u0027:change_org_user_role/2"
}
],
"repo": "https://github.com/nerves-hub/nerves_hub_web",
"vendor": "nerves-hub",
"versions": [
{
"lessThan": "a96497ddd4d24ab1847f7685e255bf96fd87b85b",
"status": "affected",
"version": "b5d2438677f79d10e91aeef20a7b5cd8cca0d63c",
"versionType": "git"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:nerves-hub:nerves_hub_web:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.5.3",
"versionStartIncluding": "1.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Josh Kalderimis"
},
{
"lang": "en",
"type": "reporter",
"value": "Josh Kalderimis"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Josh Kalderimis"
},
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"dateAssigned": "2026-11-09T23:03:50.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eImproper Session Invalidation vulnerability in the dashboard pages, device console and local shell channels in nerves-hub nerves_hub_web allows an organization member who is removed or given a lower role to keep acting at their old role through anything they had open at the time. The dashboard reads the member\u0027s role once when a page mounts, in the \u003ccode\u003eassign_org_to_scope\u003c/code\u003e hook of \u003ccode\u003eNervesHubWeb.Auth\u003c/code\u003e, and the console, local shell and device event stream channels check membership once at join. Removing a member or changing their role tells none of them, so open pages keep carrying out actions and open consoles keep running commands on the device until the page reloads or the socket disconnects.\u003c/p\u003e\n\u003cp\u003eThe dashboard also opens consoles over \u003ccode\u003eNervesHubWeb.UserSocket\u003c/code\u003e with a token that holds only the user\u0027s id, is accepted for 24 hours, and is not revoked by signing out, which disconnects only the session\u0027s LiveViews. Whoever holds a token taken from a page can open consoles as that user, within the user\u0027s current membership, until it expires.\u003c/p\u003e\n\u003cp\u003eThis issue affects nerves_hub: from 1.0.0 before 2.5.3.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Improper Session Invalidation vulnerability in the dashboard pages, device console and local shell channels in nerves-hub nerves_hub_web allows an organization member who is removed or given a lower role to keep acting at their old role through anything they had open at the time. The dashboard reads the member\u0027s role once when a page mounts, in the `assign_org_to_scope` hook of `NervesHubWeb.Auth`, and the console, local shell and device event stream channels check membership once at join. Removing a member or changing their role tells none of them, so open pages keep carrying out actions and open consoles keep running commands on the device until the page reloads or the socket disconnects.\n\nThe dashboard also opens consoles over `NervesHubWeb.UserSocket` with a token that holds only the user\u0027s id, is accepted for 24 hours, and is not revoked by signing out, which disconnects only the session\u0027s LiveViews. Whoever holds a token taken from a page can open consoles as that user, within the user\u0027s current membership, until it expires.\n\nThis issue affects nerves_hub: from 1.0.0 before 2.5.3."
}
],
"value": "Improper Session Invalidation vulnerability in the dashboard pages, device console and local shell channels in nerves-hub nerves_hub_web allows an organization member who is removed or given a lower role to keep acting at their old role through anything they had open at the time. The dashboard reads the member\u0027s role once when a page mounts, in the assign_org_to_scope hook of NervesHubWeb.Auth, and the console, local shell and device event stream channels check membership once at join. Removing a member or changing their role tells none of them, so open pages keep carrying out actions and open consoles keep running commands on the device until the page reloads or the socket disconnects.\n\nThe dashboard also opens consoles over NervesHubWeb.UserSocket with a token that holds only the user\u0027s id, is accepted for 24 hours, and is not revoked by signing out, which disconnects only the session\u0027s LiveViews. Whoever holds a token taken from a page can open consoles as that user, within the user\u0027s current membership, until it expires.\n\nThis issue affects nerves_hub: from 1.0.0 before 2.5.3."
}
],
"impacts": [
{
"capecId": "CAPEC-60",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eA member who is removed from an organization or given a lower role keeps their old access through whatever they had open at the time, including device consoles and local shells that run commands on the device, until the page reloads or the socket disconnects. Anyone holding the dashboard\u0027s socket token taken from a page can open consoles as that user, within that user\u0027s current permissions, for up to 24 hours after they sign out.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "A member who is removed from an organization or given a lower role keeps their old access through whatever they had open at the time, including device consoles and local shells that run commands on the device, until the page reloads or the socket disconnects. Anyone holding the dashboard\u0027s socket token taken from a page can open consoles as that user, within that user\u0027s current permissions, for up to 24 hours after they sign out."
}
],
"value": "A member who is removed from an organization or given a lower role keeps their old access through whatever they had open at the time, including device consoles and local shells that run commands on the device, until the page reloads or the socket disconnects. Anyone holding the dashboard\u0027s socket token taken from a page can open consoles as that user, within that user\u0027s current permissions, for up to 24 hours after they sign out."
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 2.3,
"baseSeverity": "LOW",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "LOW",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1464",
"description": "CWE-1464 Improper Session Invalidation",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-1465",
"description": "CWE-1465 Improper Session Invalidation after User Logout",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T10:43:57.738Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"name": "Removing or demoting an org member doesn\u2019t close pages and consoles they already have open",
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/nerves-hub/nerves_hub_web/security/advisories/GHSA-c7jf-qcx9-xxf8"
},
{
"name": "EEF CNA record for CVE-2026-120997",
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-120997.html"
},
{
"name": "OSV record EEF-CVE-2026-120997",
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-120997"
},
{
"name": "Introducing commit b5d2438 in nerves-hub/nerves_hub_web",
"tags": [
"related"
],
"url": "https://github.com/nerves-hub/nerves_hub_web/commit/b5d2438677f79d10e91aeef20a7b5cd8cca0d63c"
},
{
"name": "Fix commit a96497d in nerves-hub/nerves_hub_web",
"tags": [
"patch"
],
"url": "https://github.com/nerves-hub/nerves_hub_web/commit/a96497ddd4d24ab1847f7685e255bf96fd87b85b"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Improper session invalidation keeps removed or demoted members\u0027 open pages and device consoles working at their old role",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAfter removing a member or lowering their role, restart the web nodes. That closes every open page and console, and each one is checked again when it reconnects. A socket token cannot be revoked before it expires short of changing \u003ccode\u003eSECRET_KEY_BASE\u003c/code\u003e, which signs everyone out.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "After removing a member or lowering their role, restart the web nodes. That closes every open page and console, and each one is checked again when it reconnects. A socket token cannot be revoked before it expires short of changing `SECRET_KEY_BASE`, which signs everyone out."
}
],
"value": "After removing a member or lowering their role, restart the web nodes. That closes every open page and console, and each one is checked again when it reconnects. A socket token cannot be revoked before it expires short of changing SECRET_KEY_BASE, which signs everyone out."
}
],
"x_proofOfConcept": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003col\u003e\n\u003cli\u003eIn an organization, A is an admin and B has the manage role. B opens a device\u0027s page and its Console tab.\u003c/li\u003e\n\u003cli\u003eA removes B from the organization on the organization\u0027s Users page, or lowers B\u0027s role to view.\u003c/li\u003e\n\u003cli\u003eWithout reloading, B\u0027s open page still carries out actions and B\u0027s console still accepts input, until B reloads the page or the socket disconnects.\u003c/li\u003e\n\u003cli\u003eFor the socket token: while signed in, copy the \u003ccode\u003edata-user-token\u003c/code\u003e attribute of the \u003ccode\u003e#console\u003c/code\u003e element, sign out, and within 24 hours connect a Phoenix socket client to \u003ccode\u003e/socket/websocket\u003c/code\u003e with that token. Joining \u003ccode\u003euser:console:identifier-\u0026lt;device identifier\u0026gt;\u003c/code\u003e succeeds.\u003c/li\u003e\n\u003c/ol\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "1. In an organization, A is an admin and B has the manage role. B opens a device\u0027s page and its Console tab.\n2. A removes B from the organization on the organization\u0027s Users page, or lowers B\u0027s role to view.\n3. Without reloading, B\u0027s open page still carries out actions and B\u0027s console still accepts input, until B reloads the page or the socket disconnects.\n4. For the socket token: while signed in, copy the `data-user-token` attribute of the `#console` element, sign out, and within 24 hours connect a Phoenix socket client to `/socket/websocket` with that token. Joining `user:console:identifier-\u003cdevice identifier\u003e` succeeds."
}
],
"value": "* In an organization, A is an admin and B has the manage role. B opens a device\u0027s page and its Console tab.\n* A removes B from the organization on the organization\u0027s Users page, or lowers B\u0027s role to view.\n* Without reloading, B\u0027s open page still carries out actions and B\u0027s console still accepts input, until B reloads the page or the socket disconnects.\n* For the socket token: while signed in, copy the data-user-token attribute of the #console element, sign out, and within 24 hours connect a Phoenix socket client to /socket/websocket with that token. Joining user:console:identifier-\u003cdevice identifier\u003e succeeds."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-120997",
"datePublished": "2026-11-10T10:43:57.738Z",
"dateReserved": "2026-11-05T14:30:01.700Z",
"dateUpdated": "2026-11-10T10:43:57.738Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Loading…
Loading…
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
Loading timeline…
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.