Skip to contentNerves-hub Nerves Hub Web vulnerabilities
- nerves-hub nerves hub webSession fixation in the CLI login flow allows an unauthenticated attacker to obtain a user's API tokenCVE-2026-1194469.4 Critical
- nerves-hub nerves hub webMissing authorization in device and deployment group page events allows view-role members to change devices and deployment groupsCVE-2026-1202865.3 Medium
- nerves-hub nerves hub webImproper session invalidation keeps removed or demoted members' open pages and device consoles working at their old roleCVE-2026-1209972.3 Low
- nerves-hub nerves hub webMass assignment of organization, product and deployment group IDs allows users to write into other organizations and receive their firmwareCVE-2026-1207308.6 High
- nerves-hub nerves hub webImproper authentication lets Google sign-in and confirmation links sign users in to accounts registered with their email address by someone elseCVE-2026-1209997.4 High
- nerves-hub nerves hub webIncorrect authorization in the devices page bulk move allows view-role members to move devices into another organization and receive its firmwareCVE-2026-1202957.1 High
- nerves-hub nerves hub web, nerveshub +1 moreImproper authorization in device bulk actions and device update API allows cross-organization device controlCVE-2026-288069.4 Critical
- nerves-hub nerveshub, nerves hub web +1 moreNervesHub has Insufficient Token Entropy that Allows Authentication Bypass via Brute ForceCVE-2025-640979.5 Critical