# CVE-2026-46622: SolidInvoice plaintext storage of API tokens

Source: https://junglewise.ai/threats/cve-2026-46622-solidinvoice-plaintext-storage-of-api-tokens  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-11. Updated: 2026-06-11  
License: CC BY 4.0 with a link back

CVE-2026-46622 · Severity: high · CVSS 8.1 · Published 2026-06-11

SolidInvoice is an open-source platform used by businesses to manage invoicing, clients, and payments. A security flaw was identified where the secret tokens used to access the system's programming interface (API) were stored in the database as plain text rather than being securely scrambled. If an attacker gains access to the database—for example, through a separate security breach or a leaked backup—they could steal these tokens to impersonate users and access sensitive financial records or modify business data.

Technologies: [SolidInvoice](https://junglewise.ai/threats/technologies/solidinvoice). Vendors: [SolidInvoice](https://junglewise.ai/threats/vendors/solidinvoice).

## Quick answers

**Is CVE-2026-46622 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-46622 being exploited in the wild.

**How severe is CVE-2026-46622?** High severity, with a CVSS score of 8.1, published 11 June 2026.

**Which products and versions are affected?** SolidInvoice <= 2.3.16.

**Is there a fix for CVE-2026-46622?** A patch was published on 2026-05-15: Fix committed to repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-46622 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-46622?** Check whether you run SolidInvoice at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

SolidInvoice prior to version 2.3.17 suffers from CWE-312 (Cleartext Storage of Sensitive Information). While API tokens are generated with sufficient entropy, they are stored as raw strings in the `api_tokens` database table and authenticated using simple plaintext equality checks in `ApiTokenRepository.php`. An attacker who gains read access to the database via SQL injection, misconfigured backups, or insider access can retrieve these tokens to perform unauthorized REST API requests. The vulnerability has been addressed in version 2.3.17 by migrating to HMAC-SHA256 hashing (keyed by the application secret) for token storage and verification.

## Affected products

- SolidInvoice SolidInvoice <= 2.3.16

## Timeline

- 2026-05-15: patched: Fix committed to repository
- 2026-05-18: advisory: GitHub Security Advisory published
- 2026-06-11: disclosed: CVE published to NVD

## References

- [https://github.com/SolidInvoice/SolidInvoice/commit/864539182572e1a3b2d76999b03060661ffa00f1](https://github.com/SolidInvoice/SolidInvoice/commit/864539182572e1a3b2d76999b03060661ffa00f1)
- [https://github.com/SolidInvoice/SolidInvoice/releases/tag/2.3.17](https://github.com/SolidInvoice/SolidInvoice/releases/tag/2.3.17)
- [https://github.com/SolidInvoice/SolidInvoice/security/advisories/GHSA-qjfc-h39r-cgwq](https://github.com/SolidInvoice/SolidInvoice/security/advisories/GHSA-qjfc-h39r-cgwq)

## Related threats

- [SolidInvoice authorization bypass in API token history grid](https://junglewise.ai/threats/cve-2026-61688-solidinvoice-authorization-bypass-in-api-token-history-grid)
- [SolidInvoice DataGrid unserialize() deserialization vulnerability](https://junglewise.ai/threats/cve-2026-61686-solidinvoice-datagrid-unserialize-deserialization-vulnerability)
- [SolidInvoice REST API credential exposure via query parameter](https://junglewise.ai/threats/cve-2026-61614-solidinvoice-rest-api-credential-exposure-via-query-parameter)
- [SolidInvoice user invitation indefinite validity](https://junglewise.ai/threats/cve-2026-61608-solidinvoice-user-invitation-indefinite-validity)
- [SolidInvoice IDOR in LiveComponent allows cross-user data access](https://junglewise.ai/threats/solidinvoice-idor-in-livecomponent-allows-cross-user-data-access-95c68549)