Nerves-hub vulnerabilities
We track 6 vulnerabilities in Nerves-hub products across 2 products. 6 are rated high or critical, and none are known to be exploited. The most recent was published on November 10, 2026.
Latest Nerves-hub vulnerabilities
- 7.4 High severity
nerves_hub_web: Improper Authentication
Improper Authentication vulnerability in Google sign-in and email confirmation in nerves-hub nerves_hub_web allows an attacker who registers another person's email address to share that person's account once they sign in. NervesHub.Accounts.update_or_create_us
- 8.6 High severity
nerves_hub_web: Authorization Bypass Through User-Controlled Key
Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in the device API, device forms, signing key and product forms and JITP settings in nerves-hub nerves_hub_web allows an authenticated user who manages devices in any o
- 7.1 High severity
nerves_hub_web: Incorrect Authorization
Incorrect Authorization vulnerability in the devices page bulk move in nerves-hub nerves_hub_web allows an authenticated user with the manage role in one organization and only the view role in another to move devices into the second organization's product via
- 9.4 Critical severity
nerves_hub_web: Session Fixation
Session Fixation vulnerability in the CLI login flow in nerves-hub nerves_hub_web allows an unauthenticated attacker to obtain an API token for another user's account via a crafted login link. Starting a CLI login with POST /api/auth/cli_session needs no authe
- 8.8 High severity
nerves_hub_web: Improper Authorization
Improper Authorization vulnerability in nerves-hub nerves_hub_web allows cross-organization device control via device bulk actions and device update API. Missing authorization checks in the device bulk actions and device update API endpoints allow authenticate
- 9.8 Critical severity
nerves_hub_web: Use of Insufficiently Random Values
NervesHub is a web service that allows users to manage over-the-air (OTA) firmware updates of devices in the field. A vulnerability present starting in version 1.0.0 and prior to version 2.3.0 allowed attackers to brute-force user API tokens due to the predict