CVE-2025-26864

Published: May 14, 2025Modified: Jun 17, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 3.6

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

Exposure of Sensitive Information to an Unauthorized Actor, Insertion of Sensitive Information into Log File vulnerability in the OpenIdAuthorizer of Apache IoTDB. This issue affects Apache IoTDB: from 0.10.0 through 1.3.3, from 2.0.1-beta before 2.0.2. Users are recommended to upgrade to version 1.3.4 and 2.0.2, which fix the issue.

Affected (2)

Products: Apache: Iotdb

1 product

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Apache Iotdb	From 0.10.0 to 1.3.4
Apache Iotdb	Version 2.0.1 beta

Related CWEs

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Insertion of Sensitive Information into Log File

Information written to log files can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information.

References (2)

https://lists.apache.org/thread/2kcjnlypppk8qjh17dpz0jvkcpn6l162

Source: security@apache.org

Mailing ListVendor Advisory

http://www.openwall.com/lists/oss-security/2025/05/14/4

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing List

Timeline

No history available yet.