CyberzSOC

Publication detail
← Back to advisories & guidance

VA-26-092-01: Bentley Systems iTwin Platform exposed access token ↗ source

April 2, 2026 CISA Vulnerability Advisory
Source: https://github.com/cisagov/CSAF/blob/develop/csaf_files/IT/white/2026/va-26-092-01.json

Summary

Bentley Systems iTwin Platform exposed a Cesium ion access token in the source of some web pages. An unauthenticated attacker could use this token to enumerate or delete certain assets. CVE-2026-35383: Bentley Systems iTwin Platform exposed a Cesium ion access token in the source of some web pages. An unauthenticated attacker could use this token to enumerate or delete certain assets. As of 2026-03-27, the token is no longer present in the web pages and cannot be used to enumerate or delete assets.

Advisory Details CISA IT CSAF feed

Advisory ID
VA-26-092-01
Status
Final · version 1.0.0
Initial release
2026-04-02
Last revised
2026-04-02
Vendor
Bentley Systems
Critical infrastructure sectors
Information Technology
Deployed
Worldwide
Vendor headquarters
United States

As of 2026-03-27, the token is no longer present in the web pages and cannot be used to enumerate or delete assets.

Affected products (1)
  • iTwin Platform — <2026-03-27, 2026-03-27

From CISA's machine-readable CSAF 2.0 advisory (JSON).

Vulnerabilities as Stated by the Advisory

CVEWeaknessCVSS v3Details
CVE-2026-35383 CWE-540 Inclusion of Sensitive Information in Source Code 6.5 Medium Bentley Systems iTwin Platform exposed access token
Bentley Systems iTwin Platform exposed a Cesium ion access token in the source of some web pages. An unauthenticated attacker could use this token to enumerate or delete certain assets. As of 2026-03-27, the token is no longer present in the web pages and cannot be used to enumerate or delete assets. CISA SSVC — Exploitation: PoC · Automatable: Yes · Impact: Partial

Mitigation: The exposed token has been removed and no longer enables access as of 2026-03-27.

Affected, fixed & timeline

Affected:

  • iTwin Platform <2026-03-27

Fixed in:

  • iTwin Platform 2026-03-27

Scores and weakness types are as CISA or the republishing vendor stated them in this advisory; the linked CVE pages carry the independently enriched CVSS and SSVC assessments.

News Coverage

No coverage found in monitored research blogs or news feeds.

CVEs Referenced in This Publication

CVECVSSAffected
CVE-2026-35383 6.5 Medium Bentley Systems iTwin Platform Bentley Systems iTwin Platform exposed a Cesium ion access token in the source of some web pages. An unauthenticated attacker could use this token to…

Named by the advisory itself. Each CVE links to its tracked detail page.

Vendors Named in This Publication

No KEV-catalogued vendors are named in this publication.