Django REST framework

Lookup for vulnerabilities affecting packages.

Vulnerability_id VCID-5xmw-u38h-4yhs

Summary

Exposure of Sensitive Information to an Unauthorized Actor, Insertion of Sensitive Information into Log File vulnerability in the OpenIdAuthorizer of Apache IoTDB.

This issue affects Apache IoTDB: from 0.10.0 through 1.3.3, from 2.0.1-beta before 2.0.2.

Users are recommended to upgrade to version 1.3.4 and 2.0.2, which fix the issue.

Aliases

alias	CVE-2025-26864

alias	GHSA-5fc3-pqf2-57cx

alias	PYSEC-2025-60

Fixed_packages

url	pkg:maven/org.apache.iotdb/node-commons@1.3.4
purl	pkg:maven/org.apache.iotdb/node-commons@1.3.4
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.iotdb/node-commons@1.3.4

url	pkg:maven/org.apache.iotdb/node-commons@2.0.2
purl	pkg:maven/org.apache.iotdb/node-commons@2.0.2
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.iotdb/node-commons@2.0.2

url pkg:pypi/apache-iotdb@1.3.4

purl pkg:pypi/apache-iotdb@1.3.4

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-skcm-h3kp-xygf

resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/apache-iotdb@1.3.4

url pkg:pypi/apache-iotdb@2.0.2

purl pkg:pypi/apache-iotdb@2.0.2

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-skcm-h3kp-xygf

resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/apache-iotdb@2.0.2

Affected_packages

url pkg:maven/org.apache.iotdb/node-commons@0.10.0

purl pkg:maven/org.apache.iotdb/node-commons@0.10.0

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-5xmw-u38h-4yhs

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.iotdb/node-commons@0.10.0

url pkg:maven/org.apache.iotdb/node-commons@2.0.1-beta

purl pkg:maven/org.apache.iotdb/node-commons@2.0.1-beta

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-5xmw-u38h-4yhs

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.iotdb/node-commons@2.0.1-beta

url pkg:pypi/apache-iotdb@0.10.0

purl pkg:pypi/apache-iotdb@0.10.0

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-2t9e-mbwd-zybn

vulnerability	VCID-5xmw-u38h-4yhs

resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/apache-iotdb@0.10.0

url pkg:pypi/apache-iotdb@0.10.1

purl pkg:pypi/apache-iotdb@0.10.1

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-2t9e-mbwd-zybn

vulnerability	VCID-5xmw-u38h-4yhs

resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/apache-iotdb@0.10.1

url pkg:pypi/apache-iotdb@0.11.0

purl pkg:pypi/apache-iotdb@0.11.0

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-2t9e-mbwd-zybn

vulnerability	VCID-5xmw-u38h-4yhs

resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/apache-iotdb@0.11.0

url pkg:pypi/apache-iotdb@0.11.1

purl pkg:pypi/apache-iotdb@0.11.1

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-2t9e-mbwd-zybn

vulnerability	VCID-5xmw-u38h-4yhs

resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/apache-iotdb@0.11.1

url pkg:pypi/apache-iotdb@0.11.2

purl pkg:pypi/apache-iotdb@0.11.2

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-2t9e-mbwd-zybn

vulnerability	VCID-5xmw-u38h-4yhs

resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/apache-iotdb@0.11.2

url pkg:pypi/apache-iotdb@0.11.3

purl pkg:pypi/apache-iotdb@0.11.3

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-2t9e-mbwd-zybn

vulnerability	VCID-5xmw-u38h-4yhs

resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/apache-iotdb@0.11.3

url pkg:pypi/apache-iotdb@0.11.4

purl pkg:pypi/apache-iotdb@0.11.4

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-2t9e-mbwd-zybn

vulnerability	VCID-5xmw-u38h-4yhs

resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/apache-iotdb@0.11.4

url pkg:pypi/apache-iotdb@0.12.0

purl pkg:pypi/apache-iotdb@0.12.0

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-2t9e-mbwd-zybn

vulnerability	VCID-5xmw-u38h-4yhs

resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/apache-iotdb@0.12.0

url pkg:pypi/apache-iotdb@0.12.1

purl pkg:pypi/apache-iotdb@0.12.1

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-2t9e-mbwd-zybn

vulnerability	VCID-5xmw-u38h-4yhs

resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/apache-iotdb@0.12.1

url pkg:pypi/apache-iotdb@0.12.2

purl pkg:pypi/apache-iotdb@0.12.2

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-2t9e-mbwd-zybn

vulnerability	VCID-5xmw-u38h-4yhs

vulnerability	VCID-ybcb-w79y-p3ga

resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/apache-iotdb@0.12.2

url pkg:pypi/apache-iotdb@0.12.3

purl pkg:pypi/apache-iotdb@0.12.3

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-2t9e-mbwd-zybn

vulnerability	VCID-5xmw-u38h-4yhs

vulnerability	VCID-ybcb-w79y-p3ga

resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/apache-iotdb@0.12.3

url pkg:pypi/apache-iotdb@0.12.4

purl pkg:pypi/apache-iotdb@0.12.4

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-2t9e-mbwd-zybn

vulnerability	VCID-5xmw-u38h-4yhs

vulnerability	VCID-ybcb-w79y-p3ga

resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/apache-iotdb@0.12.4

url pkg:pypi/apache-iotdb@0.12.5

purl pkg:pypi/apache-iotdb@0.12.5

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-2t9e-mbwd-zybn

vulnerability	VCID-5xmw-u38h-4yhs

vulnerability	VCID-ybcb-w79y-p3ga

resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/apache-iotdb@0.12.5

url pkg:pypi/apache-iotdb@0.12.6

purl pkg:pypi/apache-iotdb@0.12.6

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-2t9e-mbwd-zybn

vulnerability	VCID-5xmw-u38h-4yhs

vulnerability	VCID-ybcb-w79y-p3ga

resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/apache-iotdb@0.12.6

url pkg:pypi/apache-iotdb@0.13.0

purl pkg:pypi/apache-iotdb@0.13.0

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-2t9e-mbwd-zybn

vulnerability	VCID-5xmw-u38h-4yhs

vulnerability	VCID-dh97-ydsf-8ken

vulnerability	VCID-egqv-s8yr-7ybs

vulnerability	VCID-mhq7-q537-sue2

resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/apache-iotdb@0.13.0

url pkg:pypi/apache-iotdb@0.13.0.post1

purl pkg:pypi/apache-iotdb@0.13.0.post1

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-2t9e-mbwd-zybn

vulnerability	VCID-5xmw-u38h-4yhs

vulnerability	VCID-dh97-ydsf-8ken

vulnerability	VCID-egqv-s8yr-7ybs

vulnerability	VCID-mhq7-q537-sue2

resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/apache-iotdb@0.13.0.post1

url pkg:pypi/apache-iotdb@0.13.1

purl pkg:pypi/apache-iotdb@0.13.1

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-5xmw-u38h-4yhs

vulnerability	VCID-dh97-ydsf-8ken

vulnerability	VCID-egqv-s8yr-7ybs

vulnerability	VCID-mhq7-q537-sue2

resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/apache-iotdb@0.13.1

url pkg:pypi/apache-iotdb@0.13.2

purl pkg:pypi/apache-iotdb@0.13.2

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-5xmw-u38h-4yhs

vulnerability	VCID-dh97-ydsf-8ken

vulnerability	VCID-egqv-s8yr-7ybs

vulnerability	VCID-mhq7-q537-sue2

resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/apache-iotdb@0.13.2

url pkg:pypi/apache-iotdb@0.13.3

purl pkg:pypi/apache-iotdb@0.13.3

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-5xmw-u38h-4yhs

vulnerability	VCID-dh97-ydsf-8ken

resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/apache-iotdb@0.13.3

url pkg:pypi/apache-iotdb@0.13.5

purl pkg:pypi/apache-iotdb@0.13.5

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-5xmw-u38h-4yhs

resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/apache-iotdb@0.13.5

url pkg:pypi/apache-iotdb@0.13.5.1

purl pkg:pypi/apache-iotdb@0.13.5.1

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-5xmw-u38h-4yhs

resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/apache-iotdb@0.13.5.1

url pkg:pypi/apache-iotdb@0.14.0rc1

purl pkg:pypi/apache-iotdb@0.14.0rc1

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-5xmw-u38h-4yhs

resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/apache-iotdb@0.14.0rc1

url pkg:pypi/apache-iotdb@1.0.0

purl pkg:pypi/apache-iotdb@1.0.0

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-5xmw-u38h-4yhs

vulnerability	VCID-skcm-h3kp-xygf

vulnerability	VCID-uqwj-scd9-bfe8

vulnerability	VCID-x1ke-vcwx-fkbz

resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/apache-iotdb@1.0.0

url pkg:pypi/apache-iotdb@1.0.1

purl pkg:pypi/apache-iotdb@1.0.1

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-5xmw-u38h-4yhs

vulnerability	VCID-skcm-h3kp-xygf

vulnerability	VCID-uqwj-scd9-bfe8

vulnerability	VCID-x1ke-vcwx-fkbz

resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/apache-iotdb@1.0.1

url pkg:pypi/apache-iotdb@1.1.0

purl pkg:pypi/apache-iotdb@1.1.0

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-5xmw-u38h-4yhs

vulnerability	VCID-skcm-h3kp-xygf

vulnerability	VCID-uqwj-scd9-bfe8

vulnerability	VCID-x1ke-vcwx-fkbz

resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/apache-iotdb@1.1.0

url pkg:pypi/apache-iotdb@1.1.2

purl pkg:pypi/apache-iotdb@1.1.2

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-5xmw-u38h-4yhs

vulnerability	VCID-skcm-h3kp-xygf

vulnerability	VCID-uqwj-scd9-bfe8

vulnerability	VCID-x1ke-vcwx-fkbz

resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/apache-iotdb@1.1.2

url pkg:pypi/apache-iotdb@1.2.0

purl pkg:pypi/apache-iotdb@1.2.0

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-5xmw-u38h-4yhs

vulnerability	VCID-skcm-h3kp-xygf

vulnerability	VCID-uqwj-scd9-bfe8

vulnerability	VCID-x1ke-vcwx-fkbz

resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/apache-iotdb@1.2.0

url pkg:pypi/apache-iotdb@1.2.1

purl pkg:pypi/apache-iotdb@1.2.1

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-5xmw-u38h-4yhs

vulnerability	VCID-skcm-h3kp-xygf

vulnerability	VCID-uqwj-scd9-bfe8

vulnerability	VCID-x1ke-vcwx-fkbz

resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/apache-iotdb@1.2.1

url pkg:pypi/apache-iotdb@1.3.0

purl pkg:pypi/apache-iotdb@1.3.0

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-5xmw-u38h-4yhs

vulnerability	VCID-skcm-h3kp-xygf

vulnerability	VCID-uqwj-scd9-bfe8

resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/apache-iotdb@1.3.0

url pkg:pypi/apache-iotdb@1.3.2

purl pkg:pypi/apache-iotdb@1.3.2

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-5xmw-u38h-4yhs

vulnerability	VCID-skcm-h3kp-xygf

vulnerability	VCID-uqwj-scd9-bfe8

resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/apache-iotdb@1.3.2

url pkg:pypi/apache-iotdb@1.3.2.post0

purl pkg:pypi/apache-iotdb@1.3.2.post0

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-5xmw-u38h-4yhs

vulnerability	VCID-skcm-h3kp-xygf

vulnerability	VCID-uqwj-scd9-bfe8

resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/apache-iotdb@1.3.2.post0

url pkg:pypi/apache-iotdb@1.3.3

purl pkg:pypi/apache-iotdb@1.3.3

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-5xmw-u38h-4yhs

vulnerability	VCID-skcm-h3kp-xygf

vulnerability	VCID-uqwj-scd9-bfe8

resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/apache-iotdb@1.3.3

url pkg:pypi/apache-iotdb@2.0.1b0

purl pkg:pypi/apache-iotdb@2.0.1b0

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-5xmw-u38h-4yhs

vulnerability	VCID-skcm-h3kp-xygf

resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/apache-iotdb@2.0.1b0

References

reference_url

https://api.first.org/data/v1/epss?cve=CVE-2025-26864

reference_id

reference_type

scores

value	0.0049
scoring_system	epss
scoring_elements	0.6588
published_at	2026-05-30T12:55:00Z

url

https://api.first.org/data/v1/epss?cve=CVE-2025-26864

reference_url

https://github.com/apache/iotdb

reference_id

reference_type

scores

value	6.9
scoring_system	cvssv4
scoring_elements	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N

value	MODERATE
scoring_system	generic_textual
scoring_elements

url

https://github.com/apache/iotdb

reference_url

https://github.com/apache/iotdb/commit/34fcaff6b72470d5ad369307dde7fae8897aea7e

reference_id

reference_type

scores

value	6.9
scoring_system	cvssv4
scoring_elements	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N

value	MODERATE
scoring_system	generic_textual
scoring_elements

url

https://github.com/apache/iotdb/commit/34fcaff6b72470d5ad369307dde7fae8897aea7e

reference_url

https://github.com/apache/iotdb/pull/14863

reference_id

reference_type

scores

value	6.9
scoring_system	cvssv4
scoring_elements	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N

value	MODERATE
scoring_system	generic_textual
scoring_elements

url

https://github.com/apache/iotdb/pull/14863

reference_url

https://github.com/pypa/advisory-database/tree/main/vulns/apache-iotdb/PYSEC-2025-60.yaml

reference_id

reference_type

scores

value	6.9
scoring_system	cvssv4
scoring_elements	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N

value	MODERATE
scoring_system	generic_textual
scoring_elements

url

https://github.com/pypa/advisory-database/tree/main/vulns/apache-iotdb/PYSEC-2025-60.yaml

reference_url

https://lists.apache.org/thread/2kcjnlypppk8qjh17dpz0jvkcpn6l162

reference_id

reference_type

scores

value	7.5
scoring_system	cvssv3.1
scoring_elements	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

value	6.9
scoring_system	cvssv4
scoring_elements	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N

value	MODERATE
scoring_system	generic_textual
scoring_elements

value	Track
scoring_system	ssvc
scoring_elements	SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-05-19T18:41:20Z/

url

https://lists.apache.org/thread/2kcjnlypppk8qjh17dpz0jvkcpn6l162

reference_url

https://nvd.nist.gov/vuln/detail/CVE-2025-26864

reference_id

reference_type

scores

value	6.9
scoring_system	cvssv4
scoring_elements	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N

value	MODERATE
scoring_system	generic_textual
scoring_elements

url

https://nvd.nist.gov/vuln/detail/CVE-2025-26864

reference_url

http://www.openwall.com/lists/oss-security/2025/05/14/4

reference_id

reference_type

scores

value	6.9
scoring_system	cvssv4
scoring_elements	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N

value	MODERATE
scoring_system	generic_textual
scoring_elements

url

http://www.openwall.com/lists/oss-security/2025/05/14/4

reference_url	https://github.com/advisories/GHSA-5fc3-pqf2-57cx
reference_id	GHSA-5fc3-pqf2-57cx
reference_type
scores
url	https://github.com/advisories/GHSA-5fc3-pqf2-57cx

Weaknesses

cwe_id	200
name	Exposure of Sensitive Information to an Unauthorized Actor
description	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

cwe_id	532
name	Insertion of Sensitive Information into Log File
description	Information written to log files can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information.

cwe_id	937
name	OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
description	Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2013.

cwe_id	1035
name	OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
description	Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017.

Exploits

Severity_range_score 4.0 - 7.5

Exploitability 0.5

Weighted_severity 0.0

Risk_score null

Resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-5xmw-u38h-4yhs

Vulnerability Instance