CVE-2026-35383: Bentley Systems iTwin Platform exposed access token
Bentley Systems iTwin Platform exposed a Cesium ion access token in the source of some web pages. An unauthenticated attacker could use this token to enumerate or delete certain assets. As of 2026-03-27, the token is no longer present in the web pages and cannot be used to enumerate or delete assets.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-35383?
CVE-2026-35383 has been classified as a medium severity vulnerability due to the potential for unauthorized access to assets.
How do I fix CVE-2026-35383?
The issue related to CVE-2026-35383 has been resolved as of March 27, 2026, by removing the exposed access token from web pages.
What are the risks associated with CVE-2026-35383?
An unauthenticated attacker could exploit CVE-2026-35383 to enumerate or delete assets using the exposed access token.
Who is affected by CVE-2026-35383?
CVE-2026-35383 affects users of the Bentley Systems iTwin Platform who might have accessed the vulnerable web pages before the token was removed.
Is CVE-2026-35383 still a threat?
As of now, CVE-2026-35383 is no longer a threat since the exposed access token has been removed from the affected platforms.