CVE-2026-126658

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-126658
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-126658.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-126658
Aliases
  • GHSA-26m9-ww2j-3cr5
Published
2026-11-11T12:24:35Z
Modified
2026-11-12T02:48:34Z
Severity
  • 5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
ByteStash 1.5.10 before 1.6.2 Insufficient Session Expiration via API Keys
Details

ByteStash 1.5.10 before 1.6.2 contains an insufficient session expiration vulnerability that allows holders of API keys to keep access after account deactivation because validateApiKey never checks account status. Attackers holding a deactivated account's API key can read, create, modify and delete its snippets via /api/snippets and use every MCP tool via /mcp.

Database specific 
{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-613"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/126xxx/CVE-2026-126658.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "range": [
                        {
                            "introduced": "1.5.10"
                        },
                        {
                            "fixed": "1.6.2"
                        }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StandardRange"
                }
            ]
        },
        {
            "extracted_events": [
                {
                    "range": [
                        {
                            "introduced": "1.5.10"
                        },
                        {
                            "fixed": "1.6.2"
                        }
                    ],
                    "source": "DESCRIPTION"
                }
            ]
        }
    ]
}
References

Affected packages

Git / github.com/jordan-dalby/bytestash

Affected ranges

Type
GIT
Repo
https://github.com/jordan-dalby/bytestash
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
eb4ecdfc30f2e7d1424137fa7fe3a9eed663218b
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "fixed": "eb4ecdfc30f2e7d1424137fa7fe3a9eed663218b"
                }
            ],
            "source": "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

v1.*
v1.0.0
v1.0.1
v1.0.2
v1.0.3
v1.0.4
v1.0.5
v1.0.6
v1.1.0
v1.2.0
v1.3.0
v1.4.0
v1.4.1
v1.5.0
v1.5.1
v1.5.10
v1.5.11
v1.5.12
v1.5.13
v1.5.14
v1.5.2
v1.5.3
v1.5.4
v1.5.5
v1.5.6
v1.5.7
v1.5.8
v1.5.9
v1.6.0
v1.6.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-126658.json"