Skip to content
OpenAdvisories
Medium VA-26-092-01 1 CVE

Bentley Systems iTwin Platform exposed access token

Published Apr 2, 2026 · Updated Apr 2, 2026

Vendor: Bentley Product: iTwin Platform

Summary

Bentley Systems iTwin Platform exposed a Cesium ion access token in the source of some web pages. An unauthenticated attacker could use this token to enumerate or delete certain assets.

Vulnerabilities 1

  • Medium 6.5
    CVE-2026-35383

    Bentley Systems iTwin Platform exposed access token

    Bentley Systems iTwin Platform exposed a Cesium ion access token in the source of some web pages. An unauthenticated attacker could use this token to enumerate or delete certain assets. As of 2026-03-27, the token is no longer present in the web pages and can…

    Bentley iTwin Platform

Revision history

  1. #1.0.0

    Initial publication