8 matches found
CVE-2026-126658
ByteStash 1.5.10 before 1.6.2 contains an insufficient session expiration vulnerability that allows holders of API keys to keep access after account deactivation because validateApiKey never checks account status. Attackers holding a deactivated account's API key can read, create, modify and dele...
CVE-2026-126658 ByteStash 1.5.10 before 1.6.2 Insufficient Session Expiration via API Keys
ByteStash 1.5.10 before 1.6.2 contains an insufficient session expiration vulnerability that allows holders of API keys to keep access after account deactivation because validateApiKey never checks account status. Attackers holding a deactivated account's API key can read, create, modify and dele...
EUVD-2026-123402
ByteStash 1.5.10 before 1.6.2 contains an insufficient session expiration vulnerability that allows holders of API keys to keep access after account deactivation because validateApiKey never checks account status. Attackers holding a deactivated account's API key can read, create, modify and dele...
CVE-2026-126658 ByteStash 1.5.10 before 1.6.2 Insufficient Session Expiration via API Keys
ByteStash 1.5.10 before 1.6.2 contains an insufficient session expiration vulnerability that allows holders of API keys to keep access after account deactivation because validateApiKey never checks account status. Attackers holding a deactivated account's API key can read, create, modify and dele...
CVE-2026-126658
ByteStash 1.5.10 before 1.6.2 contains an insufficient session expiration vulnerability that allows holders of API keys to keep access after account deactivation because validateApiKey never checks account status. Attackers holding a deactivated account's API key can read, create, modify and dele...
CVE-2026-126658
ByteStash versions 1.5.10 before 1.6.2 are vulnerable to an insufficient session expiration flaw involving API keys. The root cause is that the validateApiKey function fails to check the account status, allowing holders of API keys to maintain access even after an account has been deactivated. An...
CVE-2026-126658: jordan-dalby ByteStash: ByteStash 1.5.10 before 1.6.2 contains an insufficient session expiration vulnerability that allows holders of API keys…
ByteStash 1.5.10 before 1.6.2 contains an insufficient session expiration vulnerability that allows holders of API keys to keep access after account deactivation because validateApiKey never checks account status. Attackers holding a deactivated account's API key can read, create, modify and dele...
PT-2026-145210
ByteStash 1.5.10 before 1.6.2 contains an insufficient session expiration vulnerability that allows holders of API keys to keep access after account deactivation because validateApiKey never checks account status. Attackers holding a deactivated account's API key can read, create, modify and dele...