Overview
CVE-2025-26864 refers to an issue that allows the unauthorized exposure of sensitive information in Apache IoTDB’s OpenIdAuthorizer. The vulnerability affects versions 0.10.0 through 1.3.3 and 2.0.1-beta before 2.0.2. It poses a significant risk to the integrity and security of systems leveraging these versions of Apache IoTDB, potentially leading to data leakage or system compromise.
Vulnerability Summary
CVE ID: CVE-2025-26864
Severity: High (7.5 CVSS)
Attack Vector: Network
Privileges Required: Low
User Interaction: None
Impact: Exposure of sensitive information to an unauthorized actor, potential system compromise or data leakage
Affected Products
A new way to communicate
Ameeba Chat is built on encrypted identity, not personal profiles.
Message, call, share files, and coordinate with identities kept separate.
- • Encrypted identity
- • Ameeba Chat authenticates access
- • Aliases and categories
- • End-to-end encrypted chat, calls, and files
- • Secure notes for sensitive information
Private communication, rethought.
Product | Affected Versions
Apache IoTDB | 0.10.0 through 1.3.3
Apache IoTDB | 2.0.1-beta before 2.0.2
How the Exploit Works
The vulnerability stems from the OpenIdAuthorizer component of Apache IoTDB, which incorrectly handles sensitive information. This flaw allows an attacker to exploit the system remotely, gaining unauthorized access to sensitive information. The malicious actor can then insert this sensitive information into the log file, potentially leading to system compromise or unauthorized data leakage.
Conceptual Example Code
The following is a conceptual example of how the vulnerability might be exploited:
GET /IoTDB/OpenIdAuthorizer?info=Sensitive HTTP/1.1
Host: vulnerable_host.comIn this example, an attacker sends a GET request to the OpenIdAuthorizer component of a vulnerable Apache IoTDB instance, attempting to retrieve sensitive information.