An authentication bypass vulnerability exists in the Xerj Console API. This flaw allows existing valid tokens to create independent successor credentials. It bypasses mandatory passkey requirements during token issuance. The Xerj system converts different session types into a generic authentication object. The token creation handler does not verify if the session was passkey-backed. An attacker can exploit this by obtaining a valid API token. They can then directly invoke the token creation endpoint. This enables the creation of new credentials with the same access levels. Xerj lacks hierarchical revocation, so parent token revocation does not affect descendant tokens. This grants attackers persistent, unauthorized access, bypassing multi-factor controls. If an account owner's token is compromised, the successor token retains administrative authority. An attacker can use this to create and control an independent passkey for permanent instance control. No official patch is available as the vendor could not be reached. Users should monitor the GitHub repository for updates and install a fix when released.