MEDIUMCVSS v3.1 5.4Vulnerability
CVE-2026-126658
ByteStash 1.5.10 before 1.6.2 contains an insufficient session expiration vulnerability that allows holders of API keys to keep access after account deactivation because validateApiKey never checks account status. Attackers holding a deactivated account's API key can read, create, modify and delete its snippets via /api/snippets and use every MCP tool via /mcp.
Properties
- Severity
- MEDIUM
- Nvd fetched at
- 2026-11-11T23:49:45.533241+00:00
- Cvss score
- 5.4
- Cvss severity
- MEDIUM
- Retrieved at
- 2026-11-11T23:50:18+00:00
- Score
- 5.4
- Last source
- NVD
- Cvss version
- 3.1
- Cve id
- CVE-2026-126658
- Cvss vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
- First seen by Signal
- 2026-11-11T15:41:39+00:00
- Name
- CVE-2026-126658
- Vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
- Published at
- 2026-11-11T13:17:23.993
- Last modified
- 2026-11-11T13:17:23.993
Related Entities (1)
HAS_WEAKNESS (1)
Related research
Explore deeper with Ninja Signal's threat intelligence graph