# CVE-2026-75554: Hex.pm OAuth token refresh insufficient session expiration

Source: https://junglewise.ai/threats/cve-2026-75554-hex-pm-oauth-token-refresh-insufficient-session-expiration  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-24. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-75554 · Severity: info · Published 2026-08-24

Hex.pm is the package manager for the Erlang and Elixir ecosystem, hosting public and private package repositories. A vulnerability in the OAuth token refresh mechanism allows users removed from an organization to retain read access to that organization's private packages for up to 30 days by repeatedly refreshing their access tokens, instead of losing access immediately upon removal.

## Quick answers

**Is CVE-2026-75554 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-75554 being exploited in the wild.

**How severe is CVE-2026-75554?** Informational severity, published 24 August 2026.

**Which products and versions are affected?** Hex.pm from 2025-10-10 before 2026-08-24.

**Is there a fix for CVE-2026-75554?** A patch was published on 2026-08-24. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-75554 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-75554?** Check whether you run Hex.pm at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an insufficient session expiration issue in the OAuth token refresh grant flow. The root cause is in expand_repositories_scope/3 in lib/hexpm/permissions.ex, which only rewrites the literal "repositories" scope but allows explicitly granted scopes like "repository:<org>" or "docs:<org>" to pass through unchanged. During token refresh, a new access token is derived from the stored granted_scopes, which contains the expanded organization-specific scopes, bypassing membership verification. Because CDN edges authorize repository access using the token claims directly without querying the database, a user removed from an organization can maintain read access as long as they keep refreshing their token—bounded by the 30-day refresh token lifetime rather than the 30-minute access token lifetime. Network-based token refresh is required; no authentication bypass is needed beyond possessing a valid refresh token.

## Affected products

- Hex.pm Hex.pm from 2025-10-10 before 2026-08-24

## Timeline

- 2026-08-24: disclosed
- 2026-08-24: patched

## References

- [https://hex.pm/](https://hex.pm/)
- [https://github.com/](https://github.com/)

## Related threats

- [hexpm Denial of Service via Excessive Allocation in package extraction](https://junglewise.ai/threats/cve-2026-23940-hexpm-denial-of-service-via-excessive-allocation-in-package)