id: PYSEC-2026-2080
published: "2026-07-06T09:16:35.163Z"
modified: "2026-07-08T10:42:49.887686Z"
aliases:
- CVE-2026-24013
details: "Authentication Bypass by Spoofing vulnerability in Apache IoTDB.\nCertain Thrift RPC query handlers lack strict validation of the sessionId\nparameter. An attacker can construct requests with a forged sessionId and,\nwithout performing openSession authentication, receive valid query results.\nThis allows authentication bypass and unauthorized reading of time-series\ndata.\n\n\nThis issue affects Apache IoTDB: from 1.3.3 before 2.0.8.\n\nUsers are recommended to upgrade to version 2.0.8, which fixes the issue."
affected:
- package:
    name: apache-iotdb
    ecosystem: PyPI
    purl: pkg:pypi/apache-iotdb
  ranges:
  - type: ECOSYSTEM
    events:
    - introduced: 1.3.3
    - fixed: 2.0.8
  versions:
  - 1.3.3
  - 1.3.4
  - 2.0.1b0
  - 2.0.2
  - 2.0.3
  - 2.0.4
  - 2.0.4.dev0
  - 2.0.5
  - 2.0.6
  ecosystem_specific: {}
references:
- type: ADVISORY
  url: http://www.openwall.com/lists/oss-security/2026/07/06/11
- type: ADVISORY
  url: https://lists.apache.org/thread/6pwkgnqhbm56mvn309f87snm84s0b75y
severity:
- type: CVSS_V3
  score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N