Moole Vulnerability Database

Find real vulnerabilities before they ship

High

CVE-2025-26864

Exposure of Sensitive Information to an Unauthorized Actor, Insertion of Sensitive Information into Log File vulnerability in the OpenIdAuthorizer of Apache IoTDB. This issue affects Apache IoTDB: from 0.10.0 through 1.3.3, from 2.0.1-beta before 2.0.2. Users are recommended to upgrade to version 1.3.4 and 2.0.2, which fix the issue.

VectorNETWORK

PublishedMay 14, 2025, 11:16

Published Bysecurity@apache.org

Base Score

Score7.5

Affected Versions

Package (Ecosystem)IntroducedFixedLimit

org.apache.iotdb:node-commons(Maven)0.10.01.3.4N/A

org.apache.iotdb:node-commons(Maven)2.0.1-beta2.0.2N/A

apache-iotdb(PyPI)0.10.01.3.4N/A

apache-iotdb(PyPI)2.0.1b02.0.2N/A

References

https://lists.apache.org/thread/2kcjnlypppk8qjh17dpz0jvkcpn6l162
http://www.openwall.com/lists/oss-security/2025/05/14/4

Weakness Type

CWE-200

CVSS Metrics

Base Score

7.5

Vector String

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Base SeverityHigh

Version

3.1

Attack Vector (AV)

NETWORK