In Apache Juneau, the default REST server request logger records request headers for any request that ends in a server error without redacting them. This allows any client that can trigger a server error to have sensitive headers such as Authorization, Cookie, Proxy-Authorization, and X-API-Key written in cleartext to the application log. If an attacker can read those logs, they can harvest credentials or tokens, leading to potential account compromise or further unauthorized access. The weakness is a log message redaction flaw.

The affected product is Apache Juneau, all releases from the first stable release up through version 9.2.0. Versions 9.2.1 and later contain the fix. No other vendors or products are listed.

The CVSS base score is 10, indicating a critical vulnerability. The EPSS score is not available, and the issue is not listed in the CISA KEV catalog. The vulnerability can be exploited by any client that can induce a server error, which is a remote attack vector requiring network access to the REST API. The exploitation path relies on the server-side logging mechanism recording unsanitized headers, so an attacker does not need insider access or privileged configuration. The high score and the clear exploitability make this vulnerability a high-priority risk.