Vulnerability · Published Apr 2, 2026 · Assigned by cisa-cg
CVE-2026-35383Bentley Systems iTwin Platform exposed access token
Medium 6.5
In plain English
A medium-severity security flaw in iTwin Platform from Bentley Systems. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 21% of all known vulnerabilities).
Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)0.3%top 78.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Bentley Systems iTwin Platform exposed a Cesium ion access token in the source of some web pages. An unauthenticated attacker could use this token to enumerate or delete certain assets. As of 2026-03-27, the token is no longer present in the web pages and cannot be used to enumerate or delete assets.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Bentley Systems | iTwin Platform | 0 – before 2026-03-27 |
Weakness: CWE-540 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L