Meteroid before 2.2.0 Cross-Tenant API Token Hash Disclosure via GetApiTokenById

Advisories

Meteroid before 2.2.0 Cross-Tenant API Token Hash Disclosure via GetApiTokenById

Severity: low
Date: 11/10/2026
Affecting: Meteroid >= 0, < 2.2.0
CVE: CVE-2026-125751
CWE: CWE-639 Authorization Bypass Through User-Controlled Key
CVSS: 2.3
CVSS V4 Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
References: https://github.com/meteroid-oss/meteroid/commit/ac3fe5c2bc72b277c5329e20eba384b8653805f2
Meteroid v2.2.0 Release Notes
https://github.com/meteroid-oss/meteroid/blob/v2.1.0/modules/meteroid/crates/meteroid-api/src/apitokens/service.rs#L78-L101
https://hackmd.io/@hieund/meteroid-cross-tenant-apitoken-hash-and-coupon-status-idor
Credit: hieuPenguinnn
Description: Meteroid before 2.2.0 contains an authorization bypass vulnerability in the ApiTokensService GetApiTokenById gRPC handler that fails to apply the caller's tenant context. Authenticated users with settings:read permission can supply another tenant's API token ID to obtain its Argon2 secret hash and owning tenant ID.

Ready to get Started?

Explore VulnCheck, a next-generation Cyber Threat Intelligence platform, which provides exploit and vulnerability intelligence to help you prioritize and remediate vulnerabilities that matter.

Vulnerability Prioritization
Prioritize vulnerabilities that matter based on the threat landscape and defer vulnerabilities that don't.
Early Warning System
Real-time alerting of changes in the vulnerability landscape so that you can take action before the attacks start.

Schedule a Demo