A vulnerability in Apache APISIX basic-auth logging causes plaintext usernames and passwords to be written to error logs when log level is set to INFO or DEBUG. This exposure risks credential compromise if unauthorized parties access these logs. The issue is fixed in version 3.14.