{"id":8913,"date":"2026-11-13T22:23:15","date_gmt":"2026-11-13T22:23:15","guid":{"rendered":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-126658-bytestash-api-keys-bypass-deactivation"},"modified":"2026-11-13T22:23:15","modified_gmt":"2026-11-13T22:23:15","slug":"cve-2026-126658-bytestash-api-keys-bypass-deactivation","status":"publish","type":"post","link":"https:\/\/i10x.ai\/news\/cve-2026-126658-bytestash-api-keys-bypass-deactivation","title":{"rendered":"CVE-2026-126658: ByteStash API keys bypass account deactivation in versions before 1.6.2"},"content":{"rendered":"\n<h2 class=\"wp-block-heading\">\u26a1 Quick Take<\/h2>\n\n\n\n<ul class=\"wp-block-list\"><li><strong>What:<\/strong> ByteStash 1.5.10 through 1.6.1 do not check account status when validating API keys, so deactivated users retain full API access.<\/li><li><strong>Who is affected:<\/strong> Self-hosted ByteStash instances running versions 1.5.10 through 1.6.1 where administrators deactivate user accounts but expect API keys to stop working.<\/li><li><strong>What to do:<\/strong> Upgrade to ByteStash 1.6.2 immediately. The release notes describe this as a security patch requiring immediate update.<\/li><li><strong>Severity:<\/strong> Medium (CVSS 5.3). Attackers need a valid API key from a deactivated account.<\/li><li><strong>Fixed in:<\/strong> Version 1.6.2, released November 10, 2026.<\/li><\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">In plain English<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">ByteStash is a self-hosted tool for storing code snippets. When an administrator deactivates a user account, the web login stops working, but any API keys that user created keep working. That means a deactivated user (or anyone who has their key) can still read, create, change, and delete all the snippets in that account. Version 1.6.2 fixes this by adding a single check to the database query. If you run ByteStash, install 1.6.2 now; if you only use code snippet tools as a regular user and do not host your own ByteStash server, you can ignore this.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What happened<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">ByteStash introduced API key authentication in version 1.5.4. The <code>validateApiKey<\/code> function in <code>apiKeyRepository.js<\/code> joins the <code>api_keys<\/code> and <code>users<\/code> tables but only checks whether the key itself is active (<code>ak.is_active = 1<\/code>). It never checks the <code>users.is_active<\/code> column. When an administrator deactivates a user via the <code>PATCH \/api\/admin\/users\/:id\/toggle-active<\/code> endpoint, the system sets <code>users.is_active<\/code> to 0 but leaves all the user&#8217;s API keys in the database with <code>is_active = 1<\/code>. The JWT authentication path does enforce the account status check (in <code>middleware\/auth.js<\/code> line 124), so web login correctly returns 403 for deactivated accounts. API key requests, however, short-circuit that middleware and go straight to <code>validateApiKey<\/code>, which has no equivalent check.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The GitHub security advisory GHSA-26m9-ww2j-3cr5 includes a proof of concept showing that after deactivation, a victim&#8217;s API key can still call <code>GET \/api\/snippets<\/code>, <code>POST \/api\/snippets<\/code>, <code>DELETE \/api\/snippets\/:id<\/code>, and <code>POST \/mcp<\/code> with full MCP tool access, while the same user&#8217;s JWT token correctly returns 403. The advisory notes that deleting a user does revoke keys (because the JOIN returns no row), but deactivation, the everyday offboarding action, does not.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What you should do<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Upgrade to ByteStash 1.6.2. The release notes on GitHub state &#8220;This version introduces a couple of security patches, update immediately.&#8221; The fix adds <code>AND u.is_active = 1<\/code> to the WHERE clause in <code>validateApiKey<\/code> (commit eb4ecdf) and also revokes all API keys when an administrator deactivates an account, so reactivation does not silently restore access to keys that may have leaked.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What it means<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Account deactivation is a standard administrative control for offboarding users or responding to suspected compromise. When that control silently fails, administrators lose a key security boundary. In ByteStash, the gap existed for 18 months (version 1.5.4 through 1.6.1) and affected every installation that relied on deactivation to cut off access. The vulnerability requires an attacker to hold a valid API key, so the risk is highest in scenarios where keys were shared, logged, or exfiltrated before deactivation. The CVSS score of 5.3 reflects medium severity because the attacker needs low privileges (a valid key) but no user interaction, and the impact is limited to confidentiality and integrity of the deactivated account&#8217;s snippets, not the entire system.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Sources<\/h2>\n\n\n\n<ul class=\"wp-block-list\"><li><a href=\"https:\/\/github.com\/jordan-dalby\/ByteStash\/security\/advisories\/GHSA-26m9-ww2j-3cr5\" target=\"_blank\" rel=\"noreferrer noopener\">GitHub Security Advisory GHSA-26m9-ww2j-3cr5<\/a><\/li><li><a href=\"https:\/\/github.com\/jordan-dalby\/ByteStash\/commit\/eb4ecdfc30f2e7d1424137fa7fe3a9eed663218b\" target=\"_blank\" rel=\"noreferrer noopener\">ByteStash commit eb4ecdf<\/a><\/li><li><a href=\"https:\/\/github.com\/jordan-dalby\/ByteStash\/releases\/tag\/v1.6.2\" target=\"_blank\" rel=\"noreferrer noopener\">ByteStash v1.6.2 release notes<\/a><\/li><li><a href=\"https:\/\/www.vulncheck.com\/advisories\/bytestash-1.5.10-before-1.6.2-insufficient-session-expiration-via-api-keys\" target=\"_blank\" rel=\"noreferrer noopener\">VulnCheck advisory<\/a><\/li><li><a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2026-126658\" target=\"_blank\" rel=\"noreferrer noopener\">NVD CVE-2026-126658<\/a><\/li><li><a href=\"https:\/\/github.com\/jordan-dalby\/ByteStash\/blob\/v1.6.1\/server\/src\/repositories\/apiKeyRepository.js#L70-L78\" target=\"_blank\" rel=\"noreferrer noopener\">Vulnerable code in v1.6.1<\/a><\/li><\/ul>\n","protected":false},"excerpt":{"rendered":"<p>ByteStash versions 1.5.10 through 1.6.1 fail to revoke API keys when administrators deactivate user accounts, leaving snippet data and MCP tools accessible.<\/p>\n","protected":false},"author":2,"featured_media":8912,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"paper_title":"","paper_url":"","pdf_url":"","doi":"","arxiv_id":"","authors":"","institutions":"","paper_date":"","venue":"","peer_reviewed":false,"code_url":"","data_url":"","funding_coi":"","figure_license":"","paper_license":"","replication":"","study_models":"","study_sample":"","footnotes":"","_yoast_wpseo_primary_category":"65","_nx_sec_severity":"medium","_nx_sec_affected":"ByteStash 1.5.10 through 1.6.1","_nx_sec_status":"patch-available","_nx_sec_kicker":"ALERT: Deactivated ByteStash accounts keep API access","_nx_sec_type":"mcp","_nx_sec_vendor":"ByteStash","_nx_sec_fixed":"1.6.2","_nx_sec_action":""},"categories":[65,11,12,28],"tags":[],"companies":[],"products":[],"class_list":["post-8913","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-ai-security","category-infrastructure","category-policy-safety","category-security-defense"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.7 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>CVE-2026-126658: ByteStash API key deactivation bypass<\/title>\n<meta name=\"description\" content=\"CVE-2026-126658 lets deactivated ByteStash users keep API access. The validateApiKey function skips account status checks, leaving snippets exposed.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/i10xnews.kinsta.cloud\/cve-2026-126658-bytestash-api-keys-bypass-deactivation\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"CVE-2026-126658: ByteStash API key deactivation bypass\" \/>\n<meta property=\"og:description\" content=\"CVE-2026-126658 lets deactivated ByteStash users keep API access. The validateApiKey function skips account status checks, leaving snippets exposed.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/i10xnews.kinsta.cloud\/cve-2026-126658-bytestash-api-keys-bypass-deactivation\" \/>\n<meta property=\"og:site_name\" content=\"i10X News\" \/>\n<meta property=\"article:published_time\" content=\"2026-11-13T22:23:15+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/i10xnews.kinsta.cloud\/wp-content\/uploads\/2026\/11\/cve-2026-126658-bytestash-api-keys-bypass-deactivation-title.webp\" \/>\n\t<meta property=\"og:image:width\" content=\"1344\" \/>\n\t<meta property=\"og:image:height\" content=\"768\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/webp\" \/>\n<meta name=\"author\" content=\"Christopher Ort\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:image\" content=\"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/10\/i10x-news-og-default-1200x630-1.png\" \/>\n<meta name=\"twitter:creator\" content=\"@i10x_ai\" \/>\n<meta name=\"twitter:site\" content=\"@i10x_ai\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Christopher Ort\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"NewsArticle\",\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-126658-bytestash-api-keys-bypass-deactivation#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-126658-bytestash-api-keys-bypass-deactivation\"},\"author\":{\"name\":\"Christopher Ort\",\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#\\\/schema\\\/person\\\/d410bb7ee72febefca2c9c369939219a\"},\"headline\":\"CVE-2026-126658: ByteStash API keys bypass account deactivation in versions before 1.6.2\",\"datePublished\":\"2026-11-13T22:23:15+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-126658-bytestash-api-keys-bypass-deactivation\"},\"wordCount\":545,\"publisher\":{\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-126658-bytestash-api-keys-bypass-deactivation#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/cve-2026-126658-bytestash-api-keys-bypass-deactivation-title.webp\",\"articleSection\":[\"AI Security\",\"Infrastructure\",\"Policy &amp; Safety\",\"Security &amp; Defense\"],\"inLanguage\":\"en-US\",\"dateModified\":\"2026-11-13T22:23:15+00:00\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-126658-bytestash-api-keys-bypass-deactivation\",\"url\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-126658-bytestash-api-keys-bypass-deactivation\",\"name\":\"CVE-2026-126658: ByteStash API key deactivation bypass\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-126658-bytestash-api-keys-bypass-deactivation#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-126658-bytestash-api-keys-bypass-deactivation#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/cve-2026-126658-bytestash-api-keys-bypass-deactivation-title.webp\",\"datePublished\":\"2026-11-13T22:23:15+00:00\",\"description\":\"CVE-2026-126658 lets deactivated ByteStash users keep API access. The validateApiKey function skips account status checks, leaving snippets exposed.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-126658-bytestash-api-keys-bypass-deactivation#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-126658-bytestash-api-keys-bypass-deactivation\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-126658-bytestash-api-keys-bypass-deactivation#primaryimage\",\"url\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/cve-2026-126658-bytestash-api-keys-bypass-deactivation-title.webp\",\"contentUrl\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/cve-2026-126658-bytestash-api-keys-bypass-deactivation-title.webp\",\"width\":1344,\"height\":768,\"caption\":\"Image: AI-generated, i10X\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-126658-bytestash-api-keys-bypass-deactivation#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/i10x.ai\\\/news\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"CVE-2026-126658: ByteStash API keys bypass account deactivation in versions before 1.6.2\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#website\",\"url\":\"https:\\\/\\\/i10x.ai\\\/news\",\"name\":\"i10X News\",\"description\":\"Stay updated with the latest news and announcements from i10X.\",\"publisher\":{\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/i10x.ai\\\/news?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#organization\",\"name\":\"i10X\",\"url\":\"https:\\\/\\\/i10x.ai\\\/news\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/i10x-logo-180.png\",\"contentUrl\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/i10x-logo-180.png\",\"width\":180,\"height\":180,\"caption\":\"i10X\"},\"image\":{\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/x.com\\\/i10x_ai\",\"https:\\\/\\\/www.linkedin.com\\\/company\\\/i10x-ai\",\"https:\\\/\\\/instagram.com\\\/i10x.ai\",\"https:\\\/\\\/www.youtube.com\\\/@i10X_ai_official\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#\\\/schema\\\/person\\\/d410bb7ee72febefca2c9c369939219a\",\"name\":\"Christopher Ort\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/christopher-ort-192.webp\",\"url\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/christopher-ort-192.webp\",\"contentUrl\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/christopher-ort-192.webp\",\"caption\":\"Christopher Ort\"},\"description\":\"Christopher Ort handles SEO, AI agent workflows and PR & partnerships at i10x.ai, the all-in-one AI workspace built by i10X Global Pte. Ltd. in Singapore. He is a graduate of Friedrich-Alexander-Universit\u00e4t Erlangen-N\u00fcrnberg (FAU). He is the author of \u201cThe Style Penalty\u201d, a study published on SSRN that analyses 1,576 evaluation decisions by four frontier AI models to show how AI-written CVs fare in automated hiring screens; the research has been covered by heise online and t3n.\",\"url\":\"https:\\\/\\\/i10x.ai\\\/news\\\/author\\\/christopher-ort\",\"sameAs\":[\"https:\\\/\\\/i10x.ai\\\/blog\\\/author\\\/christopher-ort\"],\"worksFor\":{\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#organization\"},\"alumniOf\":{\"@type\":\"EducationalOrganization\",\"name\":\"Friedrich-Alexander-Universit\u00e4t Erlangen-N\u00fcrnberg (FAU)\",\"url\":\"https:\\\/\\\/www.fau.eu\"},\"subjectOf\":[{\"@type\":\"CreativeWork\",\"url\":\"https:\\\/\\\/papers.ssrn.com\\\/abstract=7426699\",\"name\":\"The Style Penalty: How AI Resume-Writing Tools Shape Outcomes in Automated Hiring Screens\"},{\"@type\":\"CreativeWork\",\"url\":\"https:\\\/\\\/www.heise.de\\\/news\\\/KI-Chatbots-bewerten-KI-Lebenslaeufe-Claude-findet-sich-besser-als-GPT-11317531.html\",\"name\":\"KI-Chatbots bewerten KI-Lebensl\u00e4ufe: Claude findet sich besser als GPT\"},{\"@type\":\"CreativeWork\",\"url\":\"https:\\\/\\\/t3n.de\\\/news\\\/bewerbung-schreiben-ki-5-fehler-1747190\\\/\",\"name\":\"Bewerbung mit KI schreiben: Diese 5 Fehler solltet ihr laut Studien vermeiden\"}]}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"CVE-2026-126658: ByteStash API key deactivation bypass","description":"CVE-2026-126658 lets deactivated ByteStash users keep API access. The validateApiKey function skips account status checks, leaving snippets exposed.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-126658-bytestash-api-keys-bypass-deactivation","og_locale":"en_US","og_type":"article","og_title":"CVE-2026-126658: ByteStash API key deactivation bypass","og_description":"CVE-2026-126658 lets deactivated ByteStash users keep API access. The validateApiKey function skips account status checks, leaving snippets exposed.","og_url":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-126658-bytestash-api-keys-bypass-deactivation","og_site_name":"i10X News","article_published_time":"2026-11-13T22:23:15+00:00","og_image":[{"width":1344,"height":768,"url":"https:\/\/i10xnews.kinsta.cloud\/wp-content\/uploads\/2026\/11\/cve-2026-126658-bytestash-api-keys-bypass-deactivation-title.webp","type":"image\/webp"}],"author":"Christopher Ort","twitter_card":"summary_large_image","twitter_image":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/10\/i10x-news-og-default-1200x630-1.png","twitter_creator":"@i10x_ai","twitter_site":"@i10x_ai","twitter_misc":{"Written by":"Christopher Ort","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"NewsArticle","@id":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-126658-bytestash-api-keys-bypass-deactivation#article","isPartOf":{"@id":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-126658-bytestash-api-keys-bypass-deactivation"},"author":{"name":"Christopher Ort","@id":"https:\/\/i10x.ai\/news\/#\/schema\/person\/d410bb7ee72febefca2c9c369939219a"},"headline":"CVE-2026-126658: ByteStash API keys bypass account deactivation in versions before 1.6.2","datePublished":"2026-11-13T22:23:15+00:00","mainEntityOfPage":{"@id":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-126658-bytestash-api-keys-bypass-deactivation"},"wordCount":545,"publisher":{"@id":"https:\/\/i10x.ai\/news\/#organization"},"image":{"@id":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-126658-bytestash-api-keys-bypass-deactivation#primaryimage"},"thumbnailUrl":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/11\/cve-2026-126658-bytestash-api-keys-bypass-deactivation-title.webp","articleSection":["AI Security","Infrastructure","Policy &amp; Safety","Security &amp; Defense"],"inLanguage":"en-US","dateModified":"2026-11-13T22:23:15+00:00"},{"@type":"WebPage","@id":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-126658-bytestash-api-keys-bypass-deactivation","url":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-126658-bytestash-api-keys-bypass-deactivation","name":"CVE-2026-126658: ByteStash API key deactivation bypass","isPartOf":{"@id":"https:\/\/i10x.ai\/news\/#website"},"primaryImageOfPage":{"@id":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-126658-bytestash-api-keys-bypass-deactivation#primaryimage"},"image":{"@id":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-126658-bytestash-api-keys-bypass-deactivation#primaryimage"},"thumbnailUrl":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/11\/cve-2026-126658-bytestash-api-keys-bypass-deactivation-title.webp","datePublished":"2026-11-13T22:23:15+00:00","description":"CVE-2026-126658 lets deactivated ByteStash users keep API access. The validateApiKey function skips account status checks, leaving snippets exposed.","breadcrumb":{"@id":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-126658-bytestash-api-keys-bypass-deactivation#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/i10xnews.kinsta.cloud\/cve-2026-126658-bytestash-api-keys-bypass-deactivation"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-126658-bytestash-api-keys-bypass-deactivation#primaryimage","url":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/11\/cve-2026-126658-bytestash-api-keys-bypass-deactivation-title.webp","contentUrl":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/11\/cve-2026-126658-bytestash-api-keys-bypass-deactivation-title.webp","width":1344,"height":768,"caption":"Image: AI-generated, i10X"},{"@type":"BreadcrumbList","@id":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-126658-bytestash-api-keys-bypass-deactivation#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/i10x.ai\/news"},{"@type":"ListItem","position":2,"name":"CVE-2026-126658: ByteStash API keys bypass account deactivation in versions before 1.6.2"}]},{"@type":"WebSite","@id":"https:\/\/i10x.ai\/news\/#website","url":"https:\/\/i10x.ai\/news","name":"i10X News","description":"Stay updated with the latest news and announcements from i10X.","publisher":{"@id":"https:\/\/i10x.ai\/news\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/i10x.ai\/news?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/i10x.ai\/news\/#organization","name":"i10X","url":"https:\/\/i10x.ai\/news\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/i10x.ai\/news\/#\/schema\/logo\/image\/","url":"https:\/\/i10xnews.kinsta.cloud\/wp-content\/uploads\/2026\/10\/i10x-logo-180.png","contentUrl":"https:\/\/i10xnews.kinsta.cloud\/wp-content\/uploads\/2026\/10\/i10x-logo-180.png","width":180,"height":180,"caption":"i10X"},"image":{"@id":"https:\/\/i10x.ai\/news\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/i10x_ai","https:\/\/www.linkedin.com\/company\/i10x-ai","https:\/\/instagram.com\/i10x.ai","https:\/\/www.youtube.com\/@i10X_ai_official"]},{"@type":"Person","@id":"https:\/\/i10x.ai\/news\/#\/schema\/person\/d410bb7ee72febefca2c9c369939219a","name":"Christopher Ort","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/10\/christopher-ort-192.webp","url":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/10\/christopher-ort-192.webp","contentUrl":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/10\/christopher-ort-192.webp","caption":"Christopher Ort"},"description":"Christopher Ort handles SEO, AI agent workflows and PR & partnerships at i10x.ai, the all-in-one AI workspace built by i10X Global Pte. Ltd. in Singapore. He is a graduate of Friedrich-Alexander-Universit\u00e4t Erlangen-N\u00fcrnberg (FAU). He is the author of \u201cThe Style Penalty\u201d, a study published on SSRN that analyses 1,576 evaluation decisions by four frontier AI models to show how AI-written CVs fare in automated hiring screens; the research has been covered by heise online and t3n.","url":"https:\/\/i10x.ai\/news\/author\/christopher-ort","sameAs":["https:\/\/i10x.ai\/blog\/author\/christopher-ort"],"worksFor":{"@id":"https:\/\/i10x.ai\/news\/#organization"},"alumniOf":{"@type":"EducationalOrganization","name":"Friedrich-Alexander-Universit\u00e4t Erlangen-N\u00fcrnberg (FAU)","url":"https:\/\/www.fau.eu"},"subjectOf":[{"@type":"CreativeWork","url":"https:\/\/papers.ssrn.com\/abstract=7426699","name":"The Style Penalty: How AI Resume-Writing Tools Shape Outcomes in Automated Hiring Screens"},{"@type":"CreativeWork","url":"https:\/\/www.heise.de\/news\/KI-Chatbots-bewerten-KI-Lebenslaeufe-Claude-findet-sich-besser-als-GPT-11317531.html","name":"KI-Chatbots bewerten KI-Lebensl\u00e4ufe: Claude findet sich besser als GPT"},{"@type":"CreativeWork","url":"https:\/\/t3n.de\/news\/bewerbung-schreiben-ki-5-fehler-1747190\/","name":"Bewerbung mit KI schreiben: Diese 5 Fehler solltet ihr laut Studien vermeiden"}]}]}},"_links":{"self":[{"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/posts\/8913","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/comments?post=8913"}],"version-history":[{"count":0,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/posts\/8913\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/media\/8912"}],"wp:attachment":[{"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/media?parent=8913"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/categories?post=8913"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/tags?post=8913"},{"taxonomy":"company","embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/companies?post=8913"},{"taxonomy":"product","embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/products?post=8913"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}