Bentley Systems iTwin Platform inadvertently exposed a Cesium ion access token within the source code of certain web pages. This token could be used by unauthenticated attackers to enumerate or delete assets associated with the platform. The vulnerability is categorized under CWE-540, indicating sensitive information disclosure in source code. The issue was addressed by removing the token from the web pages as of 2026-03-27, effectively mitigating the risk. The CVSS 3.1 base score is 6.5, reflecting a medium severity with network attack vector, low complexity, no privileges or user interaction required, and limited confidentiality and availability impact.

An unauthenticated attacker could leverage the exposed Cesium ion access token to enumerate or delete certain assets on the iTwin Platform, potentially leading to limited confidentiality and availability impact. Since the token was publicly accessible in the source code, this could allow unauthorized asset manipulation. However, the token has been removed, and no known exploits have been reported in the wild.

The vulnerability has been mitigated by removing the exposed Cesium ion access token from the web pages as of 2026-03-27. Users should ensure they are using the updated version of the platform or verify that the token is no longer present in their deployment. No further action is required if the token is confirmed removed.