The vulnerability arises from the fact that a refresh token is signed with the same claims as an access token and the CDN service accepts either token as a repository credential without verifying whether it is a refresh or an access token. As a result, a user whose organization membership or session has ended retains the ability to view the organization's private packages and documentation tarballs until the 30‑day refresh token expires. The flaw is a CWE‑613 weakness, which permits session tokens to persist longer than intended and can lead to unintended data exposure.

The affected vendor is hexpm, product hexpm. Versions from 2025‑10‑10 up to but not including 2026‑09‑22 contain the flaw.

The CVSS score of 2.3 classifies the issue as low severity. There is no EPSS score available, and it is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is possession or exposure of a valid refresh token; an attacker can then use this token to read private artifacts from any organization the token was issued for. Because the CDN performs no database lookup to differentiate token types, the token remains valid for up to 30 days even after the associated session has been revoked. The exploit does not provide code execution but allows unauthorized read‑only access.