Threat Investigation
Request a demo

CVE-2026-35383

Medium

Description

Bentley Systems iTwin Platform exposed a Cesium ion access token in the source of some web pages. An unauthenticated attacker could use this token to enumerate or delete certain assets. As of 2026-03-27, the token is no longer present in the web pages and cannot be used to enumerate or delete assets.

SeverityMedium
CVSS6.5
Exploit probability—
ProductiTwin Platform
PublishedApr 2, 2026
First seenApr 2, 2026
Weakness typeCWE-540CWE-540

How to fix

Update
  • Bentley Systems iTwin Platform2026-03-27 or later

Affected products

ProductAffected versionsFixed in
Bentley Systems iTwin Platformv < 2026-03-272026-03-27

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.