{"schema_version": "1.6.1", "id": "CVE-2026-28564", "summary": "REST Basic Authentication Accepts Stale Cached Credentials", "details": "Insufficient Session Expiration, Authentication Bypass by Capture-replay vulnerability in Apache IoTDB.\nREST Basic Authentication Accepts Stale Cached Credentials\n\n\nThis issue affects Apache IoTDB: from 1.0.0 before 2.0.10.\n\nUsers are recommended to upgrade to version 2.0.10, which fixes the issue.", "affected": [{"ranges": [{"type": "SEMVER", "events": [{"introduced": "1.0.0"}, {"fixed": "2.0.10"}]}]}], "references": [{"type": "WEB", "url": "https://lists.apache.org/thread/l38wpy7flvvfwv4rkps87l5z8gprnfy0"}]}