CVE-2025-62232

CVE-2025-62232: Apache APISIX: basic-auth logs plaintext credentials at info level

Vendor Apache Software Foundation

Product Apache APISIX

Weakness CWE-532 · Sensitive info in logs

Published October 31, 2025

Last update October 31, 2025

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

Sensitive data exposure via logging in basic-auth leads to plaintext usernames and passwords written to error logs and forwarded to log sinks when log level is INFO/DEBUG. This creates a high risk of credential compromise through log access. It has been fixed in the following commit: https://github.com/apache/apisix/pull/12629 Users are recommended to upgrade to version 3.14, which fixes this issue.

Key dates

02Disclosure timeline

October 31, 2025 CVE published

October 31, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2025-62232 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/532.html AskarLabs — CWE-532 write-up Insertion of Sensitive Information into Log File

Related vulnerabilities

04Related CVE

CVE-2024-37270 WordPress TrustedLogin Vendor plugin < 1.1.1 - Sensitive Data Exposure vulnerability CVE-2024-25095 WordPress Easy Forms for Mailchimp plugin <= 6.9.0 - Sensitive Data Exposure via Log File vulnerability CVE-2024-31254 WordPress WordPress Backup & Migration plugin <= 1.4.7 - Sensitive Data Exposure via Log File vulnerability CVE-2024-32513 WordPress Product Feed PRO for WooCommerce plugin <= 13.3.1 - Sensitive Data Exposure vulnerability CVE-2024-31247 WordPress FG Drupal to WordPress plugin <= 3.70.3 - Sensitive Data Exposure via Log File vulnerability