CVE-2026-61614: SolidInvoice's long-lived API tokens accepted as URL query parameters, exposing credentials in server logs and browser history
SolidInvoice is an open-source invoicing platform. Prior to version 3.0.1, the REST API authenticator accepts bearer tokens via a ?token= URL query parameter as a fallback to the X-API-TOKEN header. This causes long-lived API credentials to be recorded in server access logs, proxy logs, browser history, and HTTP Referer headers sent to third-party origins. Version 3.0.1 fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SolidInvoiceto a version that resolves this vulnerability.Fixed in 3.0.1
Event History
Frequently Asked Questions
Which deployments are exposed?
SolidInvoice deployments running versions before 3.0.1 are exposed because the REST API accepts bearer tokens supplied through the token URL query parameter. Version 3.0.1 fixes the issue.
What does an attacker need to exploit this?
An attacker needs access to a long-lived API token that was exposed through a URL, such as in server or proxy access logs, browser history, or Referer headers sent to third-party origins. No authentication or user interaction is required once a valid token has been obtained.
How can I determine whether credentials may already have leaked?
Review server access logs, proxy logs, browser histories, and requests to third-party origins for SolidInvoice API URLs containing a token query parameter. Tokens found in those locations should be treated as exposed credentials.
What should be done if immediate upgrading is not possible?
Avoid sending API tokens in URL query parameters and use the X-API-TOKEN header instead. Identify and replace long-lived tokens that may have been recorded in logs, browser history, or Referer data.