Password reset tokens generated by Hex.pm’s password reset flow are never automatically invalidated after creation. When a user initiates a reset, an e‑mail containing a token is sent and that token remains usable indefinitely until it is consumed. If an attacker obtains a historic copy of such an e‑mail, for example through a leaked mailbox archive, the attacker can use the stored token to reset the victim’s password without needing access to the victim's current email account. This capability gives the attacker control over the account, allowing complete takeover with full access to all of the victim’s data and privileges.

This vulnerability affects the Hex.pm platform, specifically the hexpm/hexpm repository. All releases built from commit 617e44c71f1dd9043870205f371d375c5c4d886d and earlier are vulnerable. The issue is resolved in the commit bb0e42091995945deef10556f58d046a52eb7884 and any subsequent release.

With a CVSS score of 9.5 the vulnerability is classified as critical. However, the EPSS score is below 1 % and the vulnerability is not listed in CISA’s KEV catalog, indicating a low current likelihood of exploitation. The attack path is straightforward once an attacker has accessed a leaked password‑reset email; they need only click the token link to change the password and assume the account. The risk remains high if such e‑mails are exposed, and recovery depends on the organization’s ability to update the software quickly.