CVE-2026-115333

Published: Oct 22, 2026Modified: Oct 22, 2026Deferred

8.2

Vector

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less

Source: disclosure@vulncheck.com (Secondary)

Description

Lotus through 0.10.2 contains an improper authentication vulnerability in the Go event ingestion middleware that validates API keys by prefix only, without checking the secret against the stored hashed_key. Attackers who know or obtain an API key prefix can submit usage events to POST /api/track/ as that organization, altering its metered usage and billing.

Related CWEs

CWE-287

Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

References (4)

https://github.com/uselotus/lotus

Source: disclosure@vulncheck.com

https://github.com/uselotus/lotus/blob/0.10.2/go/event-ingestion/authn/authn.go#L85-L95

Source: disclosure@vulncheck.com

https://hackmd.io/@leediay/BkUc3WL2Mx

Source: disclosure@vulncheck.com

https://www.vulncheck.com/advisories/lotus-through-0.10.2-improper-authentication-via-event-ingestion-api-key-prefix

Source: disclosure@vulncheck.com

Timeline

No history available yet.