CVE-2026-35383: iTwin Platform Token Exposure Vulnerability

CVE-2026-35383 Overview

A sensitive information disclosure vulnerability was identified in the Bentley Systems iTwin Platform where a Cesium ion access token was exposed in the source code of certain web pages. This exposure allowed unauthenticated attackers to potentially enumerate or delete specific assets by leveraging the exposed token. The vulnerability falls under CWE-540 (Inclusion of Sensitive Information in Source Code), highlighting improper handling of authentication credentials in client-facing code.

Critical Impact
Unauthenticated attackers could exploit the exposed Cesium ion access token to enumerate or delete assets on the iTwin Platform without any authentication requirements.

Affected Products

Bentley Systems iTwin Platform (web pages containing exposed Cesium ion tokens)

Discovery Timeline

2026-03-27 - Token remediated and no longer present in web pages
2026-04-02 - CVE CVE-2026-35383 published to NVD
2026-04-02 - Last updated in NVD database

Technical Details for CVE-2026-35383

Vulnerability Analysis

This vulnerability represents a classic case of sensitive information exposure through improper inclusion of authentication credentials in client-side source code. The Bentley Systems iTwin Platform inadvertently embedded a Cesium ion access token directly within the HTML or JavaScript source of certain web pages, making it visible to any user who inspected the page source.

Cesium ion is a cloud-based platform for 3D geospatial data management, and access tokens are used to authenticate API requests. When such tokens are exposed in client-side code without proper scoping or restrictions, they can be extracted and misused by malicious actors.

The attack surface is accessible over the network without requiring any authentication (network attack vector with no privileges required), making this vulnerability particularly concerning for internet-facing deployments. The impact primarily affects asset confidentiality through enumeration capabilities and availability through potential asset deletion.

Root Cause

The root cause of this vulnerability is the inclusion of sensitive authentication credentials (Cesium ion access token) directly in web page source code that is accessible to end users. This violates the security principle of keeping secrets server-side and represents a failure in secure coding practices.

Access tokens should be handled server-side or, when client-side use is unavoidable, should be scoped with minimal necessary permissions and rotated frequently. The token appears to have been embedded without adequate consideration for the exposure risk inherent in client-side code.

Attack Vector

The attack vector for this vulnerability is straightforward and requires minimal technical sophistication:

An unauthenticated attacker navigates to an affected web page on the Bentley Systems iTwin Platform
The attacker views the page source (using browser developer tools or "View Source" functionality)
The Cesium ion access token is identified within the HTML or JavaScript code
The attacker extracts the token and uses it to make authenticated API requests to Cesium ion services
With the stolen token, the attacker can enumerate assets to gather information about the target's 3D geospatial data
The attacker may also delete certain assets, causing potential data loss or service disruption

The vulnerability requires no user interaction and can be exploited entirely through network access, making it accessible to any attacker who can reach the affected web pages.

Detection Methods for CVE-2026-35383

Indicators of Compromise

Unexpected API calls to Cesium ion services from unknown IP addresses using legitimate access tokens
Unusual asset enumeration patterns or bulk asset queries
Deletion of assets without corresponding authorized user activity
Access token usage from geographic locations inconsistent with legitimate users

Detection Strategies

Monitor Cesium ion API logs for anomalous authentication patterns or requests from unexpected sources
Implement alerting on asset deletion events and correlate with user authentication records
Review web application source code for exposed secrets using automated secret scanning tools
Audit access token permissions and usage patterns for signs of unauthorized activity

Monitoring Recommendations

Enable detailed logging for all Cesium ion API interactions including source IP addresses
Set up alerts for high-volume asset enumeration requests that may indicate reconnaissance
Monitor for bulk deletion operations or unusual patterns in asset management activities
Review access token rotation logs to ensure compromised tokens are invalidated promptly

How to Mitigate CVE-2026-35383

Immediate Actions Required

Verify that your iTwin Platform deployment has been updated and no longer exposes the Cesium ion token in page source
Rotate all Cesium ion access tokens that may have been exposed
Audit asset inventories for unauthorized deletions or modifications
Review access logs for suspicious activity during the exposure period

Patch Information

Bentley Systems has remediated this vulnerability as of 2026-03-27. The Cesium ion access token is no longer present in the affected web pages and cannot be used to enumerate or delete assets. Organizations should ensure they are running the latest version of the iTwin Platform and verify that the token is no longer exposed in their deployment.

For additional technical details on Cesium ion access tokens and proper security practices, refer to the Cesium Access Tokens Guide. The official CISA advisory is available in the CISA CSAF Document.

Workarounds

Implement server-side proxying for Cesium ion API calls to avoid exposing tokens in client-side code
Apply token scoping to restrict permissions to the minimum necessary for application functionality
Enable token rotation policies to limit the impact window of any future credential exposure
Deploy web application firewalls (WAF) with rules to detect and block requests attempting to access or extract sensitive tokens from page source

bash

# Configuration example - Verify token is not exposed in page source
# Check all HTML and JavaScript files for Cesium ion tokens
grep -r "cesium.ion" /var/www/itwin/ --include="*.html" --include="*.js"
grep -r "accessToken" /var/www/itwin/ --include="*.html" --include="*.js"

# If tokens are found, ensure they are properly secured server-side
# and not directly embedded in client-accessible code