GHSA-pcv2-4g25-r7qrHighCVSS 5.9
Lotus through 0.10.2 contains an improper authentication vulnerability in the Go event ingestion...
🔗 CVE IDs covered (1)
📋 Description
Lotus through 0.10.2 contains an improper authentication vulnerability in the Go event ingestion middleware that validates API keys by prefix only, without checking the secret against the stored hashed_key. Attackers who know or obtain an API key prefix can submit usage events to POST /api/track/ as that organization, altering its metered usage and billing.
🔗 References (6)
- https://nvd.nist.gov/vuln/detail/CVE-2026-115333
- https://github.com/uselotus/lotus
- https://github.com/uselotus/lotus/blob/0.10.2/go/event-ingestion/authn/authn.go#L85-L95
- https://hackmd.io/@leediay/BkUc3WL2Mx
- https://www.vulncheck.com/advisories/lotus-through-0.10.2-improper-authentication-via-event-ingestion-api-key-prefix
- https://github.com/advisories/GHSA-pcv2-4g25-r7qr