Certain Thrift RPC query handlers in Apache IoTDB fail to enforce strict validation of the sessionId parameter. An attacker can craft requests that include a forged sessionId, causing the server to skip the openSession authentication step and return valid query results. This flaw effectively bypasses authentication controls and permits retrieval of stored time‑series data without permission.

The vulnerability impacts Apache IoTDB versions starting at 1.3.3 and up to, but not including, 2.0.8. Any deployment of these releases that exposes the Thrift RPC interface to a network reachable by an attacker is vulnerable.

The CVSS score of 9.1 indicates a high risk primarily due to confidentiality impact. The EPSS score of less than 1% suggests that exploitation in the wild is currently rare, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote access to the Thrift RPC port, as the description implies that the flaw exists in all such handlers. An attacker who can reach this port could forge a sessionId and extract data without authenticating.