CVE-2026-64943: Apache Answer: API keys logged in plaintext during authentication

[Enxin Xie <linkinstar () apache org>]

Severity: low 

Affected versions:

- Apache Answer through 2.0.2

Description:

Insertion of Sensitive Information into Log File vulnerability in Apache Answer.



This issue affects Apache Answer: through 2.0.2.

Full API keys are written to application logs on every authenticated request, allowing anyone with log-read access to 
recover and replay active bearer credentials.


Users are recommended to upgrade to version 2.0.3, which fixes the issue.

Credit:

meifukun (reporter)

References:

https://answer.apache.org
https://www.cve.org/CVERecord?id=CVE-2026-64943