Skip to content
OpenAdvisories
High · 7.5 CVE-2025-26864 EUVD-2025-14874GHSA-5fc3-pqf2-57cxPYSEC-2025-60

Apache IoTDB: Exposure of Sensitive Information in IoTDB OpenID Authentication

Published May 14, 2025 · Updated May 19, 2025 · Assigned by apache

Vendor: Apache Software Foundation Product: Apache IoTDB Package: apache-iotdb Package: org.apache.iotdb:node-commons Ecosystem: Maven Ecosystem: PyPI

Description

Exposure of Sensitive Information to an Unauthorized Actor, Insertion of Sensitive Information into Log File vulnerability in the OpenIdAuthorizer of Apache IoTDB.

This issue affects Apache IoTDB: from 0.10.0 through 1.3.3, from 2.0.1-beta before 2.0.2.

Users are recommended to upgrade to version 1.3.4 and 2.0.2, which fix the issue.

Affected products

VendorProductAffectedFixed
Apache Software Foundation Apache IoTDB 0.10.0 – ≤ 1.3.3, 2.0.1-beta – < 2.0.2 2.0.2

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.apache.iotdb:node-commons >= 0.10.0, < 1.3.4 1.3.4 GHSA-5fc3-pqf2-57cx
Maven org.apache.iotdb:node-commons >= 2.0.1-beta, < 2.0.2 2.0.2 GHSA-5fc3-pqf2-57cx
PyPI apache-iotdb >= 0.10.0, < 1.3.4 1.3.4 PYSEC-2025-60
PyPI apache-iotdb >= 2.0.1b0, < 2.0.2 2.0.2 GHSA-5fc3-pqf2-57cx

References