The vulnerability resides in the OAuth token endpoint of the hexpm platform. An API key that possesses the generic repositories permission can exchange a client credentials token and request any repository scope that begins with "repository:". Because the organization name in the scope is never checked against the key’s principal, the key gains read access to any repository in any organization, including private packages. This flaw allows an attacker with a compromised or valid API key to retrieve confidential code without belonging to the target organization.

The issue affects the hex.pm service managed by the hexpm vendor. All releases from 2025‑10‑18 up to, but not including, 2026‑08‑24 are vulnerable. Earlier versions are unaffected, and newer releases incorporate the fix.

With a CVSS score of 8.3 the threat is considered high. The exploit requires possession of an API key that already carries repositories permissions, which could be obtained through credential compromise or social engineering. Once the token is obtained, no further privileged access is needed to read the target organization’s private artifacts. The EPSS score is not available, and the vulnerability is not yet catalogued in CISA’s KEV list. Based on the description, it is inferred that because authentication to the token endpoint is not restricted by organization membership, an external attacker who obtains or guesses an API key could perform the attack remotely.