Medium severity5.4NVD Advisory· Published Nov 11, 2026
CVE-2026-126658
CVE-2026-126658
Description
ByteStash 1.5.10 before 1.6.2 contains an insufficient session expiration vulnerability that allows holders of API keys to keep access after account deactivation because validateApiKey never checks account status. Attackers holding a deactivated account's API key can read, create, modify and delete its snippets via /api/snippets and use every MCP tool via /mcp.
Affected products
2- Range: <1.6.2
Patches
Vulnerability mechanics
References
5- github.com/jordan-dalby/ByteStash/blob/v1.6.1/server/src/repositories/apiKeyRepository.jsnvd
- github.com/jordan-dalby/ByteStash/commit/eb4ecdfc30f2e7d1424137fa7fe3a9eed663218bnvd
- github.com/jordan-dalby/ByteStash/releases/tag/v1.6.2nvd
- github.com/jordan-dalby/ByteStash/security/advisories/GHSA-26m9-ww2j-3cr5nvd
- www.vulncheck.com/advisories/bytestash-1.5.10-before-1.6.2-insufficient-session-expiration-via-api-keysnvd
News mentions
0No linked articles in our index yet.