SolidInvoice's long-lived API tokens accepted as URL query parameters, exposing credentials in server logs and browser history

published 2026-09-04 2 mo ago modified 2026-09-10 59 d ago also EUVD-2026-71628

cvss: 5.9; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.4%; EPSS 0.4% chance of exploitation in 30 days, percentile 30%
public exploits: 0; none known

SolidInvoice is an open-source invoicing platform. Prior to version 3.0.1, the REST API authenticator accepts bearer tokens via a `?token=` URL query parameter as a fallback to the `X-API-TOKEN` header. This causes long-lived API credentials to be recorded in server access logs, proxy logs, browser history, and HTTP Referer headers sent to third-party origins. Version 3.0.1 fixes the issue.

Patch / fix

fixed in 1 links 1

solidinvoice solidinvoice 3.0.1

github.com/SolidInvoice/SolidInvoice/releases/tag/3.0.1 release

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 2 mo ago (2026-09-04)

Exploit prediction

0.37% chance of exploitation in the next 30 days, higher than 30% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	5.9	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected products

SolidInvoice SolidInvoice

Classification

Weakness

CWE-598 Use of HTTP Request With Sensitive Query String

References

Sources

CVE List CVE-2026-61614
NVD CVE-2026-61614

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.

Summary