Xerj AI Flaw Lets Attackers Bypass Passkey Security

A flaw in the Xerj Console API allows attackers to bypass passkey security and create new, persistent credentials for long-term access.

A critical security vulnerability has been identified in the Xerj Console, an open-source tool used for managing AI infrastructure, according to a report from the CERT Coordination Center (CERT/CC). The flaw, tracked as VU#645818, is an authentication bypass that allows an attacker to create new, unauthorized credentials. For any organization relying on Xerj to orchestrate their AI and machine learning workflows, this vulnerability represents a significant security risk. It effectively allows an attacker who has already gained a foothold—however minor—to establish a persistent and independent presence within the system. This type of flaw can be particularly dangerous because it turns a potentially temporary compromise into a long-term threat, enabling an attacker to maintain access even if the initial point of entry is discovered and closed. The disclosure puts the spotlight on the security posture of the increasingly critical tools that underpin modern AI development and deployment, urging developers and security teams to take immediate notice.

The technical mechanism behind this vulnerability lies in a logical flaw within the Xerj Console's API for issuing access tokens. In a secure system, the creation of new credentials is a highly sensitive operation that should be protected by the strongest available authentication methods. The Xerj Console was designed to use passkeys—a modern, phishing-resistant standard—to secure this process. However, the vulnerability creates a loophole where the API fails to enforce this passkey verification check under specific conditions. An attacker who possesses any existing valid token, regardless of its privilege level, can directly call the token issuance endpoint. The flawed API then incorrectly processes the request and "mints" a brand new, independent credential without ever prompting for or validating a passkey. This newly created token is not tied to the original, compromised one, meaning it will persist even if the first token is revoked. This allows an attacker to quietly escalate a low-level compromise into a durable, privileged backdoor.

This incident fits into a broader and troubling trend of API security failures in critical infrastructure. As software development increasingly relies on distributed, API-driven architectures, the attack surface shifts from monolithic applications to the complex web of interactions between services. Authentication and authorization logic within these APIs are now primary targets for attackers. The context of AI infrastructure adds another layer of severity. These platforms are the command-and-control centers for valuable corporate assets, including proprietary models, sensitive training data, and expensive computing resources. A breach here is not just a software bug; it's a fundamental compromise of a core business system. Furthermore, the bypassing of a modern security mechanism like passkeys serves as a stark reminder that the mere adoption of advanced standards is not enough. Implementation is everything. A single flaw in how a security control is enforced can completely undermine its intended protections, creating a false sense of security.

For teams using the Xerj platform, the immediate takeaway is the urgent need to patch their systems and conduct a thorough audit for any unauthorized credentials. This involves not only applying the security update but also scrutinizing system logs for any anomalous token creation activity that might indicate a past compromise. Looking forward, this vulnerability should serve as a catalyst for organizations to re-evaluate the security of their entire MLOps and AI toolchain. As the AI ecosystem rapidly expands, many new and powerful open-source tools are being adopted without the level of security vetting typically applied to traditional enterprise software. Companies must implement robust security practices, including regular vulnerability scanning, code audits for critical components, and defense-in-depth strategies that assume a breach can and will happen. The ability to detect and respond to anomalous behavior, such as unexpected credential minting, is just as important as preventing the initial intrusion.

This vulnerability undermines the security promise of passkey authentication within the Xerj AI infrastructure. For engineering and security teams, it means a single compromised token can be used to create a persistent backdoor, turning a temporary breach into a long-term, undetectable threat with potential for privilege escalation.

This flaw exposes businesses using Xerj to severe security risks, including potential data breaches and compromise of AI infrastructure. Remediating this vulnerability requires immediate auditing and patching, leading to operational costs, potential downtime, and a diversion of engineering resources from product development.