CVE-2026-94220: Apache APISIX: session fixation issue in feishu-auth and dingtalk-auth plugin
Cross-Site request forgery (CSRF) vulnerability in feishu-auth and dingtalk-auth plugins in Apache APISIX.
An attacker who can get a user to click a crafted link may cause that user's browser session on a protected route to be established under the attacker's identity instead of their own. Any work the user then performs in that session, including uploads, form submissions, and account bindings, lands in the attacker's account. This issue affects Apache APISIX: from 3.17.0 through 3.18.0.
Users are recommended to upgrade to version 3.19.0, which fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache APISIXto a version that resolves this vulnerability.Fixed in 3.19.0
Event History
Frequently Asked Questions
Which deployments are affected?
Apache APISIX deployments running versions 3.17.0 through 3.18.0 are affected when they use the feishu-auth or dingtalk-auth plugin on protected routes.
What does an attacker need to exploit this issue?
The attacker needs to convince a user to click a crafted link. Successful exploitation can establish the user's browser session on a protected route under the attacker's identity.
What is the practical impact if exploitation succeeds?
Actions the user performs in the resulting session, including uploads, form submissions, and account bindings, are applied to the attacker's account rather than the user's own account.
What version should be deployed to remediate the issue?
Upgrade Apache APISIX to version 3.19.0, which fixes the vulnerability.