← Database

CVE-2026-126658

MEDIUM CVSS: 5.4 Published: 2026-11-11 Modified: 2026-11-11

Description

ByteStash 1.5.10 before 1.6.2 contains an insufficient session expiration vulnerability that allows holders of API keys to keep access after account deactivation because validateApiKey never checks account status. Attackers holding a deactivated account's API key can read, create, modify and delete its snippets via /api/snippets and use every MCP tool via /mcp.

Affected Platforms

Unknown

Weakness Type

CWE-613

References