CVE WatchJul 24, 2026

CVE-2026-35383

Bentley Systems iTwin Platform exposed a Cesium ion access token in the source of some web pages. An unauthenticated attacker could use this

CVSS

6.5

Medium

EPSS

0.3%

p21

KEV

—

Exploit Today

0-100

Published: Apr 2, 2026 · Last modified: Jul 24, 2026 · CWE-540

EPSS · 30d

0.3%EPSS · 30 days0.3%

2026-07-262026-08-23

Technical description

Bentley Systems iTwin Platform exposed a Cesium ion access token in the source of some web pages. An unauthenticated attacker could use this token to enumerate or delete certain assets. As of 2026-03-27, the token is no longer present in the web pages and cannot be used to enumerate or delete assets.

Official references

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-165815.3 MED

13.5%

——4In igloohome Smart Lock Mobile App versions 3.2.3 and prior, an Inclusion of Sensitive Information in Source Code vulnerability could allow an unauthorized actor to access functions or backend services that were not sufficiently protected by authentication controls.25d