CVE-2026-126658

Name of the Vulnerable Software and Affected Versions ByteStash versions 1.5.10 through 1.6.1

Description Insufficient session expiration occurs because the validateApiKey() function fails to verify the account status. This allows individuals possessing API keys for deactivated accounts to maintain unauthorized access. An attacker can perform read, create, modify, and delete operations on snippets through the '/api/snippets' endpoint and utilize all MCP tools via the '/mcp' endpoint.

Recommendations Update ByteStash to version 1.6.2 or later.