CWE-1464

{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://ghcr.io",
          "cpes": [
            "cpe:2.3:a:nerves-hub:nerves_hub_web:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "\u0027Elixir.NervesHubWeb.UserSocket\u0027",
            "\u0027Elixir.NervesHubWeb.UserConsoleChannel\u0027",
            "\u0027Elixir.NervesHubWeb.UserLocalShellChannel\u0027",
            "\u0027Elixir.NervesHubWeb.DeviceEventsStreamChannel\u0027",
            "\u0027Elixir.NervesHubWeb.Auth\u0027",
            "\u0027Elixir.NervesHub.Accounts\u0027"
          ],
          "packageName": "nerves-hub/nerves-hub",
          "packageURL": "pkg:oci/nerves-hub?repository_url=ghcr.io%2Fnerves-hub",
          "product": "nerves_hub_web",
          "programFiles": [
            "lib/nerves_hub_web/channels/user_socket.ex",
            "lib/nerves_hub_web/channels/user_console_channel.ex",
            "lib/nerves_hub_web/channels/user_local_shell_channel.ex",
            "lib/nerves_hub_web/channels/device_events_stream_channel.ex",
            "lib/nerves_hub_web/auth.ex",
            "lib/nerves_hub/accounts.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.NervesHubWeb.UserSocket\u0027:connect/2"
            },
            {
              "name": "\u0027Elixir.NervesHubWeb.UserSocket\u0027:id/1"
            },
            {
              "name": "\u0027Elixir.NervesHubWeb.UserConsoleChannel\u0027:join/3"
            },
            {
              "name": "\u0027Elixir.NervesHubWeb.UserLocalShellChannel\u0027:join/3"
            },
            {
              "name": "\u0027Elixir.NervesHubWeb.DeviceEventsStreamChannel\u0027:join/3"
            },
            {
              "name": "\u0027Elixir.NervesHubWeb.Auth\u0027:on_mount/4"
            },
            {
              "name": "\u0027Elixir.NervesHubWeb.Auth\u0027:log_out_user/1"
            },
            {
              "name": "\u0027Elixir.NervesHub.Accounts\u0027:soft_delete_org_user/1"
            },
            {
              "name": "\u0027Elixir.NervesHub.Accounts\u0027:change_org_user_role/2"
            }
          ],
          "vendor": "nerves-hub",
          "versions": [
            {
              "lessThan": "2.5.3",
              "status": "affected",
              "version": "1.0.0",
              "versionType": "other"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:nerves-hub:nerves_hub_web:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "\u0027Elixir.NervesHubWeb.UserSocket\u0027",
            "\u0027Elixir.NervesHubWeb.UserConsoleChannel\u0027",
            "\u0027Elixir.NervesHubWeb.UserLocalShellChannel\u0027",
            "\u0027Elixir.NervesHubWeb.DeviceEventsStreamChannel\u0027",
            "\u0027Elixir.NervesHubWeb.Auth\u0027",
            "\u0027Elixir.NervesHub.Accounts\u0027"
          ],
          "packageName": "nerves_hub",
          "packageURL": "pkg:otp/nerves_hub?repository_url=https:%2F%2Fgithub.com%2Fnerves-hub%2Fnerves_hub_web\u0026vcs_url=git%20https:%2F%2Fgithub.com%2Fnerves-hub%2Fnerves_hub_web.git",
          "product": "nerves_hub_web",
          "programFiles": [
            "lib/nerves_hub_web/channels/user_socket.ex",
            "lib/nerves_hub_web/channels/user_console_channel.ex",
            "lib/nerves_hub_web/channels/user_local_shell_channel.ex",
            "lib/nerves_hub_web/channels/device_events_stream_channel.ex",
            "lib/nerves_hub_web/auth.ex",
            "lib/nerves_hub/accounts.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.NervesHubWeb.UserSocket\u0027:connect/2"
            },
            {
              "name": "\u0027Elixir.NervesHubWeb.UserSocket\u0027:id/1"
            },
            {
              "name": "\u0027Elixir.NervesHubWeb.UserConsoleChannel\u0027:join/3"
            },
            {
              "name": "\u0027Elixir.NervesHubWeb.UserLocalShellChannel\u0027:join/3"
            },
            {
              "name": "\u0027Elixir.NervesHubWeb.DeviceEventsStreamChannel\u0027:join/3"
            },
            {
              "name": "\u0027Elixir.NervesHubWeb.Auth\u0027:on_mount/4"
            },
            {
              "name": "\u0027Elixir.NervesHubWeb.Auth\u0027:log_out_user/1"
            },
            {
              "name": "\u0027Elixir.NervesHub.Accounts\u0027:soft_delete_org_user/1"
            },
            {
              "name": "\u0027Elixir.NervesHub.Accounts\u0027:change_org_user_role/2"
            }
          ],
          "repo": "https://github.com/nerves-hub/nerves_hub_web",
          "vendor": "nerves-hub",
          "versions": [
            {
              "lessThan": "2.5.3",
              "status": "affected",
              "version": "1.0.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://github.com",
          "cpes": [
            "cpe:2.3:a:nerves-hub:nerves_hub_web:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "\u0027Elixir.NervesHubWeb.UserSocket\u0027",
            "\u0027Elixir.NervesHubWeb.UserConsoleChannel\u0027",
            "\u0027Elixir.NervesHubWeb.UserLocalShellChannel\u0027",
            "\u0027Elixir.NervesHubWeb.DeviceEventsStreamChannel\u0027",
            "\u0027Elixir.NervesHubWeb.Auth\u0027",
            "\u0027Elixir.NervesHub.Accounts\u0027"
          ],
          "packageName": "nerves-hub/nerves_hub_web",
          "packageURL": "pkg:github/nerves-hub/nerves_hub_web",
          "product": "nerves_hub_web",
          "programFiles": [
            "lib/nerves_hub_web/channels/user_socket.ex",
            "lib/nerves_hub_web/channels/user_console_channel.ex",
            "lib/nerves_hub_web/channels/user_local_shell_channel.ex",
            "lib/nerves_hub_web/channels/device_events_stream_channel.ex",
            "lib/nerves_hub_web/auth.ex",
            "lib/nerves_hub/accounts.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.NervesHubWeb.UserSocket\u0027:connect/2"
            },
            {
              "name": "\u0027Elixir.NervesHubWeb.UserSocket\u0027:id/1"
            },
            {
              "name": "\u0027Elixir.NervesHubWeb.UserConsoleChannel\u0027:join/3"
            },
            {
              "name": "\u0027Elixir.NervesHubWeb.UserLocalShellChannel\u0027:join/3"
            },
            {
              "name": "\u0027Elixir.NervesHubWeb.DeviceEventsStreamChannel\u0027:join/3"
            },
            {
              "name": "\u0027Elixir.NervesHubWeb.Auth\u0027:on_mount/4"
            },
            {
              "name": "\u0027Elixir.NervesHubWeb.Auth\u0027:log_out_user/1"
            },
            {
              "name": "\u0027Elixir.NervesHub.Accounts\u0027:soft_delete_org_user/1"
            },
            {
              "name": "\u0027Elixir.NervesHub.Accounts\u0027:change_org_user_role/2"
            }
          ],
          "repo": "https://github.com/nerves-hub/nerves_hub_web",
          "vendor": "nerves-hub",
          "versions": [
            {
              "lessThan": "a96497ddd4d24ab1847f7685e255bf96fd87b85b",
              "status": "affected",
              "version": "b5d2438677f79d10e91aeef20a7b5cd8cca0d63c",
              "versionType": "git"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:nerves-hub:nerves_hub_web:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "2.5.3",
                  "versionStartIncluding": "1.0.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "AND"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Josh Kalderimis"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "Josh Kalderimis"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Josh Kalderimis"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Jonatan M\u00e4nnchen / EEF"
        }
      ],
      "dateAssigned": "2026-11-09T23:03:50.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eImproper Session Invalidation vulnerability in the dashboard pages, device console and local shell channels in nerves-hub nerves_hub_web allows an organization member who is removed or given a lower role to keep acting at their old role through anything they had open at the time. The dashboard reads the member\u0027s role once when a page mounts, in the \u003ccode\u003eassign_org_to_scope\u003c/code\u003e hook of \u003ccode\u003eNervesHubWeb.Auth\u003c/code\u003e, and the console, local shell and device event stream channels check membership once at join. Removing a member or changing their role tells none of them, so open pages keep carrying out actions and open consoles keep running commands on the device until the page reloads or the socket disconnects.\u003c/p\u003e\n\u003cp\u003eThe dashboard also opens consoles over \u003ccode\u003eNervesHubWeb.UserSocket\u003c/code\u003e with a token that holds only the user\u0027s id, is accepted for 24 hours, and is not revoked by signing out, which disconnects only the session\u0027s LiveViews. Whoever holds a token taken from a page can open consoles as that user, within the user\u0027s current membership, until it expires.\u003c/p\u003e\n\u003cp\u003eThis issue affects nerves_hub: from 1.0.0 before 2.5.3.\u003c/p\u003e"
            },
            {
              "base64": false,
              "type": "text/markdown",
              "value": "Improper Session Invalidation vulnerability in the dashboard pages, device console and local shell channels in nerves-hub nerves_hub_web allows an organization member who is removed or given a lower role to keep acting at their old role through anything they had open at the time. The dashboard reads the member\u0027s role once when a page mounts, in the `assign_org_to_scope` hook of `NervesHubWeb.Auth`, and the console, local shell and device event stream channels check membership once at join. Removing a member or changing their role tells none of them, so open pages keep carrying out actions and open consoles keep running commands on the device until the page reloads or the socket disconnects.\n\nThe dashboard also opens consoles over `NervesHubWeb.UserSocket` with a token that holds only the user\u0027s id, is accepted for 24 hours, and is not revoked by signing out, which disconnects only the session\u0027s LiveViews. Whoever holds a token taken from a page can open consoles as that user, within the user\u0027s current membership, until it expires.\n\nThis issue affects nerves_hub: from 1.0.0 before 2.5.3."
            }
          ],
          "value": "Improper Session Invalidation vulnerability in the dashboard pages, device console and local shell channels in nerves-hub nerves_hub_web allows an organization member who is removed or given a lower role to keep acting at their old role through anything they had open at the time. The dashboard reads the member\u0027s role once when a page mounts, in the assign_org_to_scope hook of NervesHubWeb.Auth, and the console, local shell and device event stream channels check membership once at join. Removing a member or changing their role tells none of them, so open pages keep carrying out actions and open consoles keep running commands on the device until the page reloads or the socket disconnects.\n\nThe dashboard also opens consoles over NervesHubWeb.UserSocket with a token that holds only the user\u0027s id, is accepted for 24 hours, and is not revoked by signing out, which disconnects only the session\u0027s LiveViews. Whoever holds a token taken from a page can open consoles as that user, within the user\u0027s current membership, until it expires.\n\nThis issue affects nerves_hub: from 1.0.0 before 2.5.3."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-60",
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "\u003cp\u003eA member who is removed from an organization or given a lower role keeps their old access through whatever they had open at the time, including device consoles and local shells that run commands on the device, until the page reloads or the socket disconnects. Anyone holding the dashboard\u0027s socket token taken from a page can open consoles as that user, within that user\u0027s current permissions, for up to 24 hours after they sign out.\u003c/p\u003e"
                },
                {
                  "base64": false,
                  "type": "text/markdown",
                  "value": "A member who is removed from an organization or given a lower role keeps their old access through whatever they had open at the time, including device consoles and local shells that run commands on the device, until the page reloads or the socket disconnects. Anyone holding the dashboard\u0027s socket token taken from a page can open consoles as that user, within that user\u0027s current permissions, for up to 24 hours after they sign out."
                }
              ],
              "value": "A member who is removed from an organization or given a lower role keeps their old access through whatever they had open at the time, including device consoles and local shells that run commands on the device, until the page reloads or the socket disconnects. Anyone holding the dashboard\u0027s socket token taken from a page can open consoles as that user, within that user\u0027s current permissions, for up to 24 hours after they sign out."
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 2.3,
            "baseSeverity": "LOW",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "LOW",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:L/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1464",
              "description": "CWE-1464 Improper Session Invalidation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-1465",
              "description": "CWE-1465 Improper Session Invalidation after User Logout",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-10T10:43:57.738Z",
        "orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "shortName": "EEF"
      },
      "references": [
        {
          "name": "Removing or demoting an org member doesn\u2019t close pages and consoles they already have open",
          "tags": [
            "vendor-advisory",
            "related"
          ],
          "url": "https://github.com/nerves-hub/nerves_hub_web/security/advisories/GHSA-c7jf-qcx9-xxf8"
        },
        {
          "name": "EEF CNA record for CVE-2026-120997",
          "tags": [
            "related"
          ],
          "url": "https://cna.erlef.org/cves/CVE-2026-120997.html"
        },
        {
          "name": "OSV record EEF-CVE-2026-120997",
          "tags": [
            "related"
          ],
          "url": "https://osv.dev/vulnerability/EEF-CVE-2026-120997"
        },
        {
          "name": "Introducing commit b5d2438 in nerves-hub/nerves_hub_web",
          "tags": [
            "related"
          ],
          "url": "https://github.com/nerves-hub/nerves_hub_web/commit/b5d2438677f79d10e91aeef20a7b5cd8cca0d63c"
        },
        {
          "name": "Fix commit a96497d in nerves-hub/nerves_hub_web",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/nerves-hub/nerves_hub_web/commit/a96497ddd4d24ab1847f7685e255bf96fd87b85b"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Improper session invalidation keeps removed or demoted members\u0027 open pages and device consoles working at their old role",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eAfter removing a member or lowering their role, restart the web nodes. That closes every open page and console, and each one is checked again when it reconnects. A socket token cannot be revoked before it expires short of changing \u003ccode\u003eSECRET_KEY_BASE\u003c/code\u003e, which signs everyone out.\u003c/p\u003e"
            },
            {
              "base64": false,
              "type": "text/markdown",
              "value": "After removing a member or lowering their role, restart the web nodes. That closes every open page and console, and each one is checked again when it reconnects. A socket token cannot be revoked before it expires short of changing `SECRET_KEY_BASE`, which signs everyone out."
            }
          ],
          "value": "After removing a member or lowering their role, restart the web nodes. That closes every open page and console, and each one is checked again when it reconnects. A socket token cannot be revoked before it expires short of changing SECRET_KEY_BASE, which signs everyone out."
        }
      ],
      "x_proofOfConcept": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003col\u003e\n\u003cli\u003eIn an organization, A is an admin and B has the manage role. B opens a device\u0027s page and its Console tab.\u003c/li\u003e\n\u003cli\u003eA removes B from the organization on the organization\u0027s Users page, or lowers B\u0027s role to view.\u003c/li\u003e\n\u003cli\u003eWithout reloading, B\u0027s open page still carries out actions and B\u0027s console still accepts input, until B reloads the page or the socket disconnects.\u003c/li\u003e\n\u003cli\u003eFor the socket token: while signed in, copy the \u003ccode\u003edata-user-token\u003c/code\u003e attribute of the \u003ccode\u003e#console\u003c/code\u003e element, sign out, and within 24 hours connect a Phoenix socket client to \u003ccode\u003e/socket/websocket\u003c/code\u003e with that token. Joining \u003ccode\u003euser:console:identifier-\u0026lt;device identifier\u0026gt;\u003c/code\u003e succeeds.\u003c/li\u003e\n\u003c/ol\u003e"
            },
            {
              "base64": false,
              "type": "text/markdown",
              "value": "1. In an organization, A is an admin and B has the manage role. B opens a device\u0027s page and its Console tab.\n2. A removes B from the organization on the organization\u0027s Users page, or lowers B\u0027s role to view.\n3. Without reloading, B\u0027s open page still carries out actions and B\u0027s console still accepts input, until B reloads the page or the socket disconnects.\n4. For the socket token: while signed in, copy the `data-user-token` attribute of the `#console` element, sign out, and within 24 hours connect a Phoenix socket client to `/socket/websocket` with that token. Joining `user:console:identifier-\u003cdevice identifier\u003e` succeeds."
            }
          ],
          "value": "* In an organization, A is an admin and B has the manage role. B opens a device\u0027s page and its Console tab.\n* A removes B from the organization on the organization\u0027s Users page, or lowers B\u0027s role to view.\n* Without reloading, B\u0027s open page still carries out actions and B\u0027s console still accepts input, until B reloads the page or the socket disconnects.\n* For the socket token: while signed in, copy the data-user-token attribute of the #console element, sign out, and within 24 hours connect a Phoenix socket client to /socket/websocket with that token. Joining user:console:identifier-\u003cdevice identifier\u003e succeeds."
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
    "assignerShortName": "EEF",
    "cveId": "CVE-2026-120997",
    "datePublished": "2026-11-10T10:43:57.738Z",
    "dateReserved": "2026-11-05T14:30:01.700Z",
    "dateUpdated": "2026-11-10T10:43:57.738Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}