CVE-2026-35383
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
Bentley Systems iTwin Platform exposed a Cesium ion access token in the source of some web pages. An unauthenticated attacker could use this token to enumerate or delete certain assets. The token has been removed from the web pages as of 2026-03-27.
Risk Assessment
An attacker could access Cesium ion assets, potentially leading to data leakage or asset deletion. The risk has been mitigated after token removal.
Recommendation
Verify that the token is not used elsewhere and revoke it.
Original NVD description (English source)
Bentley Systems iTwin Platform exposed a Cesium ion access token in the source of some web pages. An unauthenticated attacker could use this token to enumerate or delete certain assets. As of 2026-03-27, the token is no longer present in the web pages and cannot be used to enumerate or delete assets.