CVE-2026-126658— ByteStash 1.5.10 before 1.6.2 Insufficient Session Expiration via API Keys

Quick assessment

Affected

jordan-dalby ByteStash

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

ByteStash 1.5.10 至 1.6.2 之前的版本存在会话过期机制不足的安全漏洞。由于函数未检查账户状态，持有 API 密钥的用户在账户被停用后仍可保持访问权限。攻击者若掌握已停用账户的 API 密钥，即可通过接口读取、创建、修改和删除该账户的代码片段，并可通过接口使用所有 MCP 工具。

CVSS 5.4 · Medium Updated Nov 11, 2026

Possible ATT&CK Techniques 2 AI

T1078 · Valid Accounts T1552 · Unsecured Credentials

Affected Version Matrix 2

Vendor	Product	Version Range	Status
jordan-dalby	ByteStash	`1.5.10< 1.6.2`	affected
		`1.6.2`	unaffected

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

ByteStash 1.5.10 before 1.6.2 Insufficient Session Expiration via API Keys

Source: CVE Program / CVE List V5

Vulnerability Description

ByteStash 1.5.10 before 1.6.2 contains an insufficient session expiration vulnerability that allows holders of API keys to keep access after account deactivation because validateApiKey never checks account status. Attackers holding a deactivated account's API key can read, create, modify and delete its snippets via /api/snippets and use every MCP tool via /mcp.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

不充分的会话过期机制

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
jordan-dalby	ByteStash	1.5.10 ~ 1.6.2	-

II. Public POCs for CVE-2026-126658

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-126658

请登录查看更多情报信息。

Other References for CVE-2026-126658 (5)

https://github.com/jordan-dalby/ByteStash/blob/v1.6.1/server/src/repositories/apiKeyRepository.js#L70-L78 technical-description
https://github.com/jordan-dalby/ByteStash/commit/eb4ecdfc30f2e7d1424137fa7fe3a9eed663218b patch
https://github.com/jordan-dalby/ByteStash/releases/tag/v1.6.2 release-notes
https://github.com/jordan-dalby/ByteStash/security/advisories/GHSA-26m9-ww2j-3cr5 vendor-advisory
https://www.vulncheck.com/advisories/bytestash-1.5.10-before-1.6.2-insufficient-session-expiration-via-api-keys third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-126658

IV. Related Vulnerabilities

Same weakness: CWE-613