Description
ByteStash 1.5.10 before 1.6.2 contains an insufficient session expiration vulnerability that allows holders of API keys to keep access after account deactivation because validateApiKey never checks account status. Attackers holding a deactivated account's API key can read, create, modify and delete its snippets via /api/snippets and use every MCP tool via /mcp.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| jordan-dalby | ByteStash | 1.5.10 – < 1.6.2 | 1.6.2 |
References
- GitHub Security Advisory (GHSA-26m9-ww2j-3cr5) vendor-advisory
- https://github.com/jordan-dalby/ByteStash/commit/eb4ecdfc30f2e7d1424137fa7fe3a9eed663218b patch
- ByteStash v1.6.2 Release Notes release-notes
- https://github.com/jordan-dalby/ByteStash/blob/v1.6.1/server/src/repositories/apiKeyRepository.js#L70-L78 technical-description
- NetbyteSEC Advisory NBS-2026-0003 third-party-advisory
- VulnCheck Advisory: ByteStash 1.5.10 before 1.6.2 Insufficient Session Expiration via API Keys third-party-advisory