The vulnerability involves the iTwin Platform exposing a Cesium ion access token in the source of several web pages. An attacker without authentication can use the token to enumerate or delete certain assets, thereby compromising both the confidentiality and integrity of platform data. The weakness aligns with CWE‑540, which concerns the exposure of information via public channels.

Bentley Systems iTwin Platform is affected. Specific version information is not provided in the advisory, so all instances of the product should be verified for the presence of the exposed token.

The CVSS score is 6.9, indicating a medium severity vulnerability. EPSS information is unavailable and the issue is not listed in the CISA KEV catalog. The attack vector is inferred to be unauthenticated access to web pages, where the token can be discovered in source code. Exploitation is likely straightforward given the public availability of the page content, making the risk moderate but significant for any organization still exposing the token.