CVE-2026-35383
Medium · 6.5CVSS
6.5
EPSS
0.5%
Published
Apr 2, 2026
CISA due date
—
The record
Bentley Systems iTwin Platform exposed a Cesium ion access token in the source of some web pages. An unauthenticated attacker could use this token to enumerate or delete certain assets. As of 2026-03-27, the token is no longer present in the web pages and cannot be used to enumerate or delete assets.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-84390 A inclusion of sensitive information in source code vulnerability in Fortinet… CWE-540
- CVE-2026-45728 Algernon is a small self-contained pure-Go web server. CWE-540
- CVE-2026-4155 ChargePoint Home Flex Inclusion of Sensitive Information in Source Code Information… CWE-540
- CVE-2026-22275 Dell ECS, versions 3.8.1.0 through 3.8.1.7, and Dell ObjectScale versions prior to… CWE-540