CVE-2026-28564: apache software foundation apache iotdb Authentication Bypass by Capture-replay
Vulnerability summary
CVE-2026-28564 is a critical (CVSS 9.8) Authentication Bypass by Capture-replay vulnerability in apache software foundation apache iotdb. EPSS estimates a 0.68% chance of exploitation in the next 30 days, higher than 51.5% of scored vulnerabilities.
Timeline
- 10-07-2026PublishedVulnerability first disclosed.
- 10-07-2026Last modifiedVulnerability information updated.
Description
Insufficient Session Expiration, Authentication Bypass by Capture-replay vulnerability in Apache IoTDB. REST Basic Authentication Accepts Stale Cached Credentials This issue affects Apache IoTDB: from 1.0.0 before 2.0.10. Users are recommended to upgrade to version 2.0.10, which fixes the issue.
CVSS metrics
2 scores · 2 sources · 1 version- NVDNIST9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
0.68%
Chance of exploitation in the next 30 days
Percentile
52%
Versus all other CVEs
30-day change
0.00 pp
From 0.68% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-294Authentication Bypass by Capture-replayA capture-replay flaw exists when the design of the product makes it possible for a malicious user to sniff network traffic and bypass authentication by replaying it to the server in question to the same effect as the original message (or with minor changes).
- CWE-613Insufficient Session ExpirationAccording to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."
Affected systems
Apache software foundation1 product
- apache iotdb≥ 1.0.0, < 2.0.10
1 vendor · 1 product
References
2 links- lists.apache.org/thread/l38wpy7flvvfwv4rkps87l5z8gprnfy0Vendor Advisory