Threats tagged 'ghsa-45rq-x49h-cmwp'

1 threat

Severity	CVSS	Threat	Source	Published	Score and star
Medium	5.3	CVE-2026-126658ByteStash 1.5.10 before 1.6.2 contains an insufficient session expiration vulnerability that allows holders of API Medium5.32026-11-11GCVE DatabaseCVE-2026-126658 ByteStash versions from 1.5.10 up to but not including 1.6.2 have a vulnerability where API keys remain valid even after the associated account is deactivated. This occurs because the validateApiKey function does not verify the account status. As a result, attackers with a deactivated account's API key can access and manipulate snippets and use all MCP tools. Report on CVE-2026-126658 Vulnerability CWE-613 #ghsa-45rq-x49h-cmwp	GCVE Database	2026-11-11

Page 1 of 1