Executive brief
Hex.pm is the package manager for the Erlang and Elixir ecosystem, hosting public and private package repositories. A vulnerability in the OAuth token refresh mechanism allows users removed from an organization to retain read access to that organization's private packages for up to 30 days by repeatedly refreshing their access tokens, instead of losing access immediately upon removal.
Technical details
The vulnerability is an insufficient session expiration issue in the OAuth token refresh grant flow. The root cause is in expand_repositories_scope/3 in lib/hexpm/permissions.ex, which only rewrites the literal "repositories" scope but allows explicitly granted scopes like "repository:<org>" or "docs:<org>" to pass through unchanged. During token refresh, a new access token is derived from the stored granted_scopes, which contains the expanded organization-specific scopes, bypassing membership verification. Because CDN edges authorize repository access using the token claims directly without querying the database, a user removed from an organization can maintain read access as long as they keep refreshing their token—bounded by the 30-day refresh token lifetime rather than the 30-minute access token lifetime. Network-based token refresh is required; no authentication bypass is needed beyond possessing a valid refresh token.
Affected products
- Hex.pm Hex.pm from 2025-10-10 before 2026-08-24
Timeline
- 2026-08-24: disclosed
- 2026-08-24: patched