Executive brief
SolidInvoice is an open-source invoicing platform used to manage invoices and customer billing. The REST API accepts authentication tokens as URL query parameters, causing long-lived API credentials to be recorded in server logs, browser history, and forwarded to third-party services. An attacker who gains access to these logs obtains persistent administrative access to the platform without the token owner's knowledge.
Technical details
The vulnerability is an insecure credential transmission issue (CWE-598) in the REST API authenticator. The ApiTokenAuthenticator accepts bearer tokens via the ?token= URL query parameter as a fallback to the X-API-TOKEN header. Unlike header-based authentication, query parameters are logged by default in web server access logs (nginx, Apache, Caddy), reverse proxy logs, browser history, HTTP Referer headers to third-party origins, and APM tools. SolidInvoice API tokens are HMAC-SHA256 keyed values with no automatic expiry; once exposed in logs, they grant indefinite API access until manually revoked. The fix (version 3.0.1) removes query parameter fallback and requires exclusive use of the X-API-TOKEN header. No authentication or user interaction is required to exploit this via log access.
Affected products
- SolidInvoice SolidInvoice prior to 3.0.1
Timeline
- 2026-07-16: disclosed
- 2026-06-23: patched: version 3.0.1 released
- 2026-09-04: advisory