CVE-2026-94276: Apache APISIX: Openid-connect introspection validation issue
Improper Authentication vulnerability in Apache APISIX.
On a route using openid-connect plugin with remote introspection against an authorization server that serves multiple issuers, a token that introspects as active for one issuer may get accepted on a route restricted to another. This issue affects Apache APISIX: from 3.12.0 through 3.18.0.
Users are recommended to upgrade to version 3.19.0, which fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache APISIXto a version that resolves this vulnerability.Fixed in 3.19.0
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Apache APISIX versions 3.12.0 through 3.18.0 are affected when a route uses the openid-connect plugin with remote token introspection against an authorization server that serves multiple issuers. The described issue does not establish exposure for routes that do not use that configuration.
What does an attacker need to exploit it?
An attacker needs a token that the authorization server introspects as active for one issuer. The vulnerable route must be restricted to a different issuer while using the same multi-issuer authorization server for remote introspection.
How should affected deployments be remediated?
Upgrade Apache APISIX to version 3.19.0, which fixes the issue. The provided information does not specify an alternative mitigation if upgrading is not immediately possible.
How can I determine whether a route may be affected?
Review routes using the openid-connect plugin and identify those configured for remote introspection. A route may be affected if its authorization server serves multiple issuers and the route restricts tokens to a particular issuer.