CVE-2026-88897: Flextype CMS through 1.0.0-alpha.3 API Token Exposure via Query String
Flextype CMS through 1.0.0-alpha.3 accepts API authentication credentials through URL query string parameters in REST API routes. Attackers with access to web server, proxy, or monitoring logs can recover valid API token pairs that grant full API access.
Affected Software
Event History
Frequently Asked Questions
Who is realistically exposed to token theft?
Deployments are exposed when API credentials are sent in REST API URL query parameters and the resulting URLs are recorded by web servers, reverse proxies, or monitoring systems. Anyone who can access those logs may recover valid API token pairs.
What access does an attacker need to exploit this?
The attacker does not need prior application privileges, but must be able to view logs or monitoring data that captured REST API request URLs containing the credentials. Recovered token pairs grant full API access.
What can be done if an update is not immediately possible?
Avoid placing API authentication credentials in REST API query strings, and restrict access to web server, proxy, and monitoring logs that may contain previously captured URLs. Treat tokens found in such logs as exposed and replace them.
How can administrators determine whether credentials may already be exposed?
Review web server, proxy, and monitoring logs for REST API URLs containing API authentication query parameters. Any valid token pair present in those records should be considered compromised because it can grant full API access.