oss-security - CVE-2026-64943: Apache Answer: API keys logged in plaintext during authentication

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <de3669d9-af8a-cb46-8e25-649cf75e3813@apache.org>
Date: Fri, 16 Oct 2026 03:30:52 +0000
From: Enxin Xie <linkinstar@...che.org>
To: oss-security@...ts.openwall.com
Subject: CVE-2026-64943: Apache Answer: API keys logged in plaintext during
 authentication 

Severity: low 

Affected versions:

- Apache Answer through 2.0.2

Description:

Insertion of Sensitive Information into Log File vulnerability in Apache Answer.

This issue affects Apache Answer: through 2.0.2.

Full API keys are written to application logs on every authenticated request, allowing anyone with log-read access to recover and replay active bearer credentials.

Users are recommended to upgrade to version 2.0.3, which fixes the issue.

Credit:

meifukun (reporter)

References:

https://answer.apache.org
https://www.cve.org/CVERecord?id=CVE-2026-64943

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.