Bentley Systems iTwin Platform Access Token Exposure Vulnerability

A vulnerability exists in Bentley Systems iTwin Platform due to the exposure of a Cesium ion access token in the source code of certain web pages. This token, which is no longer present as of March 27, 2026, could have been used by an unauthenticated attacker to enumerate or delete specific assets.

Impact

Exploitation of this vulnerability allowed for unauthorized enumeration or deletion of assets using the exposed Cesium ion access token.

Remediation

The exposed token has been removed and no longer enables access as of March 27, 2026.