CVE-2025-62232
published 2025-10-31CVE-2025-62232: Sensitive data exposure via logging in basic-auth leads to plaintext usernames and passwords written to error logs and forwarded to log sinks when log level is…
PriorityP342high7.5CVSS 3.1
AVNACLPRNUINSUCHINAN
EPSS
0.48%
40.2th percentile
Sensitive data exposure via logging in basic-auth leads to plaintext usernames and passwords written to error logs and forwarded to log sinks when log level is INFO/DEBUG. This creates a high risk of credential compromise through log access.
It has been fixed in the following commit: https://github.com/apache/apisix/pull/12629
Users are recommended to upgrade to version 3.14, which fixes this issue.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | apisix | >= 1.0 < 3.14.0 | 3.14.0 |
| apache_software_foundation | apache_apisix | >= 1.0 < 3.14 | 3.14 |
| traefik | traefik | >= 3.6.11 < 3.7.13 | 3.7.13 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Traefik: BasicAuth singleflight coalescing reintroduces an unauthenticated username-enumeration timing oracle
ghsa·2026-09-22
CVE-2026-88010 [MEDIUM] CWE-208 Traefik: BasicAuth singleflight coalescing reintroduces an unauthenticated username-enumeration timing oracle
Traefik: BasicAuth singleflight coalescing reintroduces an unauthenticated username-enumeration timing oracle
## Summary
Traefik's BasicAuth middleware coalesces concurrent credential checks through a `singleflight.Group` to avoid hashing the same password many times at once. Since v3.6.11 the deduplication key was built from the submitted password plus the stored secret, so it depended on server state: a non-existent username collapsed onto one shared key while each configured username produced its own. Under attacker-controlled concurrency, a probe request arriving inside a leader request's in-flight window is served the leader's fast coalesced result when the username does not exist, but computes its own hash (slow) when the username exists — reintroducing, only in the concurrent case
GHSA
GHSA-3h2w-68px-r4v5: Sensitive data exposure via logging in basic-auth leads to plaintext usernames and passwords written to error logs and forwarded to log sinks when log
ghsa_unreviewed·2025-10-31
CVE-2025-62232 [HIGH] CWE-532 GHSA-3h2w-68px-r4v5: Sensitive data exposure via logging in basic-auth leads to plaintext usernames and passwords written to error logs and forwarded to log sinks when log
Sensitive data exposure via logging in basic-auth leads to plaintext usernames and passwords written to error logs and forwarded to log sinks when log level is INFO/DEBUG. This creates a high risk of credential compromise through log access.
It has been fixed in the following commit: https://github.com/apache/apisix/pull/12629
Users are recommended to upgrade to version 3.14, which fixes this issue.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2025-10-31
Published