Avalonia security incident: CMS breach, packages and customer data unaffected

Avalonia reported that unauthorised access during the 22-23 October 2026 attack was limited to its marketing website CMS. The entry point was an administrator token accidentally embedded in browser-delivered JavaScript. All 39 attempts to publish to its NuGet feeds were rejected, and customers need not reset passwords or replace licence keys.

Key points

• Unauthorised access stayed within the marketing site's CMS; the customer portal and licensing systems were not affected.
• All 39 attempts to publish to the NuGet feeds were rejected, and no package tampering was found.
• The root cause was an environment variable with an admin token that was embedded into client-side JavaScript; check your own builds for similar leaks.
• Customers do not need to reset portal passwords, replace licence keys or reinstall packages.
• The attacker used Tor, rented cloud servers and disposable accounts, so blocking single IP addresses was not enough.

Avalonia confirmed that an unauthorised attack starting on 22 October 2026, aimed at several of its services, reached only the content management system behind its marketing website. The attacker used an administrator token that had been unintentionally bundled into client-side JavaScript. The company has revoked the token, redeployed the site without it, and tightened CMS permissions.

According to the company, customer portal records, payment data, licence keys and restricted source code were not accessed, and none of the 39 attempts to publish packages to its NuGet feeds succeeded. Developers therefore do not need to reset portal passwords, replace licence keys or reinstall packages. The investigation is still open, and the post will be updated if the assessment changes.

Real-world use

• A desktop team consuming Avalonia NuGet packages reviewing its package sources and dependencies after the incident.
• A team whose website connects to a CMS or admin API verifying that no admin tokens reach browser bundles.
• An organisation with commercial Avalonia licences checking its portal account and licence status against the company's guidance.

Why it matters

Developers using Avalonia need no action on packages or licences. The lasting lesson is that a server-side secret can leak into client bundles through build and environment configuration, so those setups deserve a review.

Related stories

• Publish Visual Studio Marketplace extensions securely with Trusted PublishingMDMicrosoft for Developers Blog5 d ago
• PHP2Shell and Azure DevOps: what Pipelines users should checkDOAzure DevOps BlogOct 26
• Mastering Rate Limiting and Resource Governance for MCP Servers at ScaleDVDEV Community: #aspnetcore1 d ago