Clear text passwords visible in jaws.log when LoginSessionVendorImpl is set to DEBUG

Products

• Automation Analytics & Intelligence

Issue/Introduction

When the logger com.termalabs.server.cache.LoginSessionVendorImpl is set to DEBUG level in Automation Analytics & Intelligence (AAI), clear text passwords for users logging in via the REST API or Thick Client are exposed in the jaws.log file.

DEBUG [LoginSessionVendorImpl] onLogin("LoginSessionCreatedEvent(sessionIdentifier=..., clientHostName=..., clientType=RestApi, timeIn=..., credential=JawsCredential(valid=false, username=aai_user, password=PLAIN_TEXT_PASSWORD_HERE, ...)")

Environment

• Product: Automation Analytics & Intelligence (AAI)
• Versions: All versions prior to 26.0
• Component: AAI Server / Login Authentication

Resolution

This issue is a confirmed defect tracked under DE197544. A permanent fix that masks sensitive credentials in log files is fixed in the AAI 26.0.0 release.

Workaround

To mitigate this security risk immediately, disable the DEBUG logging level for the affected class:

1. Log in to the AAI Configuration Tool (Thick Client).
2. Navigate to the Logging tab.
3. Locate the logger named: com.termalabs.server.cache.LoginSessionVendorImpl.
4. Change the level from DEBUG to INFO.
5. Click Apply and then OK to save the changes.
   • Note: Changes take effect within approximately 30 seconds and do not require a service restart.