Itwin Platform CVE-2026-35383

The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) indicates network-accessible, low-complexity unauthenticated attack with no user interaction required. However, the scope of impact is limited: confidentiality (VC:L) and integrity (VA:L) are rated as low, with no changes to system availability or safety-related impacts. EPSS data is not provided, but the combination of a low-complexity, unauthenticated attack vector against a real credential disclosure incident suggests moderate real-world exploitation risk. The critical mitigating factor is that Bentley Systems revoked the token on 2026-03-27, rendering it non-functional regardless of whether attackers extracted it earlier. The vulnerability represents a real information disclosure event but with time-limited impact due to swift remediation and token revocation. Organizations should assess whether asset enumeration or deletion occurred during the window of exposure, but ongoing risk is now minimal since the token no longer grants access.

An attacker inspects the HTML source of an iTwin Platform web page, discovers the embedded Cesium ion access token, extracts it, and uses it to authenticate to Cesium ion APIs. The attacker then enumerates the list of geospatial assets managed under that token and deletes critical infrastructure visualization data or terrain models. This attack requires no authentication or special privilege, only network access to the web page and basic ability to view page source, making it trivial to execute. However, exploitation occurred only during the window of exposure (before 2026-03-27), as the token has since been revoked.