Executive brief
Hex.pm is the official package manager for the Erlang/Elixir ecosystem. A flaw in its OAuth token endpoint allows an API key with repositories permission to obtain unauthorized read access to private packages belonging to other organizations. An attacker with a legitimate API key could exploit this to steal proprietary package code from competing organizations.
Technical details
The vulnerability is an incorrect authorization flaw in the OAuth client_credentials token exchange flow (lib/hexpm_web/controllers/api/oauth_controller.ex). The validate_scopes_against_key/2 function fails to validate the organization context of a requested scope; when an API key holds the repositories permission, any scope string beginning with "repository:" passes validation without verifying the organization name matches the key principal. The expand_repositories_scope/3 function only rewrites the literal repositories scope, leaving explicit repository:<name> requests unchanged. CDN edge nodes authorize repository access directly from the token claim without database validation, resulting in minted tokens with read access to an unintended organization's private packages until expiration. An attacker needs a valid API key with repositories permission; no network or user interaction bypass is required.
Affected products
- Hex Hex.pm from 2025-10-18 before 2026-08-24
Timeline
- 2026-08-24: disclosed
- 2026-08-24: patched