The SolidInvoice REST API authenticator accepts bearer tokens through a `?token=` URL query parameter when the `X-API-TOKEN` header is not present. This fallback mechanism results in long‑lived API credentials being written to server access logs, proxy logs, browser history, and HTTP Referer headers that may be sent to third‑party destinations. The vulnerability exposes sensitive authentication data in environments where logs are accessible to administrators, third parties, or attackers who can read them, potentially allowing unauthorized access to the invoicing system. The weakness is identified as CWE‑598.

All installations of SolidInvoice that use API authentication and run a version earlier than 3.0.1 are affected. The issue arises in the core API authentication code and applies to any deployment where clients rely on bearer tokens for REST access, regardless of the hosting environment.

The CVSS score of 5.9 indicates medium severity, reflecting the risk of credential compromise rather than immediate code execution. EPSS is not available, so the likelihood of exploitation cannot be quantified, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector requires network access to the API endpoint and involves sending a request that includes the token in the query string; the lurking risk is that an attacker could manipulate the query to force token logging or exposure through referer leakage to external sites. The attack does not grant direct privileged operation, but the exposed tokens can be reused elsewhere, making the flaw significant in environments where logs are accessible to untrusted parties.