HyperCloud versions 2.3.5 through 2.6.8 allowed refresh tokens to be used directly for resource access while failing to invalidate prior access tokens when a refresh token was used. Because refresh tokens normally last about a year, an attacker who obtains a refresh token could use it as an access token to continue interacting with the platform without any token rotation. At the same time, previous access tokens remain valid even after a refresh, allowing the attacker to use multiple valid tokens concurrently or beyond the intended session lifetime. This flaw enables prolonged unauthorized access if either token is disclosed.

The vulnerability affects SoftIron’s HyperCloud platform, specifically versions 2.3.5 through 2.6.8.

The CVSS score is 6.2, indicating medium severity, while the EPSS score is below 1% and the vulnerability is not listed in CISA’s KEV catalog. Based on the description, the attack vector requires an authenticated client to have a refresh token that can be captured or exposed to an attacker. The flaw allows that attacker to bypass normal token rotation and maintain continuous access, presenting a moderate risk of sustained compromise. The low EPSS and lack of KEV listing suggest exploitation is not yet widespread, but the long lifetime of the tokens makes the potential impact significant if an attacker gains them.