CVE-2026-115333

MEDIUM 5.9

Lotus through 0.10.2 Improper Authentication via Event Ingestion API Key Prefix

CVSS Score

5.9

EPSS Score

0.0%

EPSS Percentile

0th

Lotus through 0.10.2 contains an improper authentication vulnerability in the Go event ingestion middleware that validates API keys by prefix only, without checking the secret against the stored hashed_key. Attackers who know or obtain an API key prefix can submit usage events to POST /api/track/ as that organization, altering its metered usage and billing.

CWE	CWE-287
Vendor	uselotus
Product	lotus
Published	Oct 22, 2026

Stay Ahead of the Next One

Get instant alerts for uselotus lotus

Be the first to know when new medium vulnerabilities affecting uselotus lotus are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Affected Versions

uselotus / lotus

0 ≤ 0.10.2

References

NVD ↗ CVE.org ↗ EPSS Data ↗

hackmd.io: https://hackmd.io/@leediay/BkUc3WL2Mx github.com: https://github.com/uselotus/lotus/blob/0.10.2/go/event-ingestion/authn/authn.go#L85-L95 github.com: https://github.com/uselotus/lotus vulncheck.com: https://www.vulncheck.com/advisories/lotus-through-0.10.2-improper-authentication-via-event-ingestion-api-key-prefix

Credits

leediay153 from Viettel Post