CVE-2025-26864 — Apache IoTDB: Exposure of Sensitive Information in IoTDB OpenID Authentication

Description (CNA)

Exposure of Sensitive Information to an Unauthorized Actor, Insertion of Sensitive Information into Log File vulnerability in the OpenIdAuthorizer of Apache IoTDB. This issue affects Apache IoTDB: from 0.10.0 through 1.3.3, from 2.0.1-beta before 2.0.2. Users are recommended to upgrade to version 1.3.4 and 2.0.2, which fix the issue.

Affected (CNA)

Vendor / product	Versions
Apache Software Foundation / Apache IoTDB	affected 0.10.0 through 1.3.3; affected 2.0.1-beta before 2.0.2

CWE

CWE-200, CWE-532

References

https://lists.apache.org/thread/2kcjnlypppk8qjh17dpz0jvkcpn6l162

ADP enrichment

CVE

No English description supplied.

http://www.openwall.com/lists/oss-security/2025/05/14/4

CISA-ADP

No English description supplied.

No references supplied.