ByteStash: Insufficient session expiration via API keys after account deactivation
Summary
ByteStash 1.5.10 up to before 1.6.2 does not check the account status when validating API keys. An attacker holding the API key of a deactivated account can keep access and read, create, modify and delete that account's snippets via the REST API and use all MCP tools. The attacker needs a valid API key that was issued before the account was deactivated.
Affected
- ByteStash 1.5.10 up to, but not including, 1.6.2
Fixed in
- Fixed in ByteStash 1.6.2
Workaround
- No vendor workaround is documented; apply the update to 1.6.2.
- Interim measure (not from the vendor): manually delete API keys belonging to deactivated accounts.
Exploitation
- Not known to be exploited according to OffSeq.
- No public proof of concept or exploit was found at the time of writing.
Our recommendation
- Update ByteStash to 1.6.2 or later in the normal patch cycle; prioritise internet-facing instances and instances using MCP.
- Until patched, review the user list and delete API keys of deactivated accounts.
- Check the registration settings of your instances and verify that former staff no longer hold active keys.
- Monitor API access logs for requests using keys of deactivated accounts.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE Record CVE-2026-126658 www.cve.org
- GitHub Security Advisory GHSA-26m9-ww2j-3cr5 github.com
- ByteStash release v1.6.2 github.com
- ByteStash pull request #385 github.com
- VulnCheck advisory www.vulncheck.com
- OffSeq Radar threat entry radar.offseq.com
- Strix CVE entry www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 17:38.
Original description (NVD)
ByteStash 1.5.10 before 1.6.2 contains an insufficient session expiration vulnerability that allows holders of API keys to keep access after account deactivation because validateApiKey never checks account status. Attackers holding a deactivated account's API key can read, create, modify and delete its snippets via /api/snippets and use every MCP tool via /mcp.
NVD references (7)
- https://github.com/jordan-dalby/ByteStash/blob/v1.6.1/server/src/repositories/apiKeyRepository.js#L70-L78
- https://github.com/jordan-dalby/ByteStash/commit/eb4ecdfc30f2e7d1424137fa7fe3a9eed663218b
- https://github.com/jordan-dalby/ByteStash/releases/tag/v1.6.2
- https://github.com/jordan-dalby/ByteStash/security/advisories/GHSA-26m9-ww2j-3cr5
- https://notes.netbytesec.com/2026/11/cve-2026-126658-bytestash-1510-before.html
- https://www.vulncheck.com/advisories/bytestash-1.5.10-before-1.6.2-insufficient-session-expiration-via-api-ke…
- https://github.com/jordan-dalby/ByteStash/security/advisories/GHSA-26m9-ww2j-3cr5
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.