{"id":"CVE-2026-61614","aliases":["EUVD-2026-71628","GHSA-mp4c-675j-mv67"],"status":"published","title":"SolidInvoice's long-lived API tokens accepted as URL query parameters, exposing credentials in server logs and browser history","description":"SolidInvoice is an open-source invoicing platform. Prior to version 3.0.1, the REST API authenticator accepts bearer tokens via a `?token=` URL query parameter as a fallback to the `X-API-TOKEN` header. This causes long-lived API credentials to be recorded in server access logs, proxy logs, browser history, and HTTP Referer headers sent to third-party origins. Version 3.0.1 fixes the issue.","severity":{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00366,"percentile":0.30885,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-598"],"published":"2026-09-04T17:48:16Z","modified":"2026-10-28T02:30:26Z","products":[{"vendor":"solidinvoice","product":"solidinvoice"}],"references":[{"url":"https://github.com/SolidInvoice/SolidInvoice/security/advisories/GHSA-mp4c-675j-mv67","tags":["x_refsource_CONFIRM","advisory"]},{"url":"https://github.com/SolidInvoice/SolidInvoice/releases/tag/3.0.1","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/61xxx/CVE-2026-61614.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-61614","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-61614","title":"SolidInvoice's long-lived API tokens accepted as URL query parameters, exposing credentials in server logs and browser history","description":"SolidInvoice is an open-source invoicing platform. Prior to version 3.0.1, the REST API authenticator accepts bearer tokens via a `?token=` URL query parameter as a fallback to the `X-API-TOKEN` header. This causes long-lived API credentials to be recorded in server access logs, proxy logs, browser history, and HTTP Referer headers sent to third-party origins. Version 3.0.1 fixes the issue.","status":"published","published":"2026-09-04T17:48:16.842Z","modified":"2026-09-04T18:40:17.637Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-598"],"updated_at":"2026-11-02T14:19:53.4444Z"}],"euvd":[{"id":"EUVD-2026-71628","description":"SolidInvoice is an open-source invoicing platform. Prior to version 3.0.1, the REST API authenticator accepts bearer tokens via a `?token=` URL query parameter as a fallback to the `X-API-TOKEN` header. This causes long-lived API credentials to be recorded in server access logs, proxy logs, browser history, and HTTP Referer headers sent to third-party origins. Version 3.0.1 fixes the issue.","status":"published","published":"2026-09-04T17:48:16Z","modified":"2026-09-04T18:40:17Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T18:01:11.238356Z"}],"nvd":[{"id":"CVE-2026-61614","description":"SolidInvoice is an open-source invoicing platform. Prior to version 3.0.1, the REST API authenticator accepts bearer tokens via a `?token=` URL query parameter as a fallback to the `X-API-TOKEN` header. This causes long-lived API credentials to be recorded in server access logs, proxy logs, browser history, and HTTP Referer headers sent to third-party origins. Version 3.0.1 fixes the issue.","status":"published","published":"2026-09-04T18:17:55.29Z","modified":"2026-09-10T15:13:07.09Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-598"],"updated_at":"2026-11-02T14:12:44.082631Z"}],"osv":[{"id":"CVE-2026-61614","title":"SolidInvoice's long-lived API tokens accepted as URL query parameters, exposing credentials in server logs and browser history","description":"SolidInvoice is an open-source invoicing platform. Prior to version 3.0.1, the REST API authenticator accepts bearer tokens via a `?token=` URL query parameter as a fallback to the `X-API-TOKEN` header. This causes long-lived API credentials to be recorded in server access logs, proxy logs, browser history, and HTTP Referer headers sent to third-party origins. Version 3.0.1 fixes the issue.","status":"published","published":"2026-09-04T17:48:16.842Z","modified":"2026-10-28T02:30:26.652613414Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-598"],"updated_at":"2026-11-02T15:45:12.933503Z"}]}}