CVE-2026-21622

When a user initiates a password reset procedure, the Hex service sends an email with a reset token embedded in a link. This token has no time-based expiration mechanism — it remains valid indefinitely until it is used. The function responsible for token verification ('Elixir.Hexpm.Accounts.PasswordReset':can_reset?/3) does not check its issuance date. If the victim's email archive leaks (for example, due to a security breach at another service), an attacker can use any unused reset token contained in that archive and change the password to the Hex account.

An attacker can take over a user account on the Hex platform (Account Takeover), gaining the ability to publish, modify, or delete Elixir packages belonging to the victim, which can lead to further compromise of software supply chain integrity.

Update hexpm to a version containing commit bb0e42091995945deef10556f58d046a52eb7884, which introduces time-based expiration for password reset tokens. Details available in vendor references: https://github.com/hexpm/hexpm/commit/bb0e42091995945deef10556f58d046a52eb7884 and https://github.com/hexpm/hexpm/security/advisories/GHSA-6r94-pvwf-mxqm

Application hexpm (hexpm/hexpm) — commits from 617e44c71f1dd9043870205f371d375c5c4d886d to (not including) bb0e42091995945deef10556f58d046a52eb7884