CVE-2025-26864CWE-200CWE-532

Apache IoTDB: Exposure of Sensitive Information in IoTDB OpenID Authentication

High · published May 14, 2025

CVSS v3.1
7.5
EPSS
1%
Percentile
54.3
In the wild
Unconfirmed
What it is

Exposure of Sensitive Information to an Unauthorized Actor, Insertion of Sensitive Information into Log File vulnerability in the OpenIdAuthorizer of Apache IoTDB.

This issue affects Apache IoTDB: from 0.10.0 through 1.3.3, from 2.0.1-beta before 2.0.2.

Users are recommended to upgrade to version 1.3.4 and 2.0.2, which fix the issue.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00746 · 54.3th percentile
Weaknesses
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor; CWE-532 · Insertion of Sensitive Information into Log File
Published
2025-05-14T10:44Z
EPSS history
Timeline
  • 14 MAY 10:44Z
    Apache IoTDB: Exposure of Sensitive Information in IoTDB OpenID Authentication
    cvelistv5