TL;DR CERT/CC published a vulnerability note on October 27, 2026, disclosing an unpatched Xerj authentication bypass tracked as CVE-2026-97406. This flaw allows attackers with existing bearer tokens to mint persistent credentials without required passkey verifications. Consequently, unauthorized users can maintain permanent administrative access even after administrators revoke the initial token. Why It Matters Xerj serves as an open-source search engine tailored for artificial intelligence agents using the Elasticsearch API.

TL;DR CERT/CC published a vulnerability note on October 27, 2026, disclosing an unpatched Xerj authentication bypass tracked as CVE-2026-97406. This flaw allows attackers with existing bearer tokens to mint persistent credentials without required passkey verifications. Consequently, unauthorized users can maintain permanent administrative access even after administrators revoke the initial token. Why It Matters Xerj serves as an open-source search engine tailored for artificial intelligence agents using the Elasticsearch API.