← CVE index
Vulnerability record/PUBLISHED/Published Nov 11, 2026 12:24:35 UTC

CVE-2026-126658

ByteStash 1.5.10 before 1.6.2 contains an insufficient session expiration vulnerability that allows holders of API keys to keep access after account deactivation because validateApiKey never checks account status. Attackers holding a deactivated account's API key can read, create, modify and delete its snippets via /api/snippets and use every MCP tool via /mcp.

Base score5.3/ 10
SeverityMediumCVSS 4.0

Exploitability / impact

CVSS metric breakdown

Vector-derived attributes
Base severityMedium
Attack vectorNetworkAV
Attack complexityLowAC
Attack requirementsNoneAT
Privileges requiredLowPR
User interactionNoneUI
Vulnerable system confidentialityLowVC
Vulnerable system integrityLowVI
Vulnerable system availabilityNoneVA
Subsequent system confidentialityNoneSC
Subsequent system integrityNoneSI
Subsequent system availabilityNoneSA
CVSS vector stringCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

CVSS communicates standardized severity and impact characteristics. It does not establish whether a system is exploitable in your specific environment.

Record context

CVE Numbering AuthorityVulnCheck
Last updatedNov 14, 2026 13:05:32 UTC
PublishedNov 11, 2026 12:24:35 UTC
ReservedNov 11, 2026 11:58:21 UTC

Credits

  • Adib Farhan
  • Jordan Dalby