Apache Answer writes the complete API key to the application log on every authenticated request. The logged credential can be recovered by anyone who has read access to the logs, enabling replay of the bearer token and full impersonation of the legitimate user. This flaw is an example of inserting sensitive information into an unencrypted log file (CWE-532).

The vulnerability affects all releases of Apache Answer up through version 2.0.2 published by the Apache Software Foundation. Users of those versions should verify their deployment and plan to upgrade to the patched release, 2.0.3, which removes the logging of credentials.

The flaw provides an information disclosure that is highly valuable to an attacker who can read the logs. It does not allow arbitrary code execution or remote privilege escalation, but it does enable credential replay. Because the vulnerability is tied to log file access, the exploitation risk is moderate to high depending on the security of the log environment. No exploit code has been published, and the vulnerability is not listed in CISA KEV. The EPSS score is not available. The patch removes the logging behavior, eliminating the risk.