https://seclists.org/oss-sec/2026/q4/4: CVE-2026-94220: Apache APISIX: session fixation issue in feishu-auth and dingtalk-auth plugin

Q: Which deployments are exposed to this issue?

Apache APISIX deployments running versions 3.17.0 through 3.18.0 are affected when they use the feishu-auth or dingtalk-auth plugin on protected routes.

Q: What must an attacker do to exploit it?

The attacker must persuade a user to click a crafted link. Successful exploitation causes the user's browser session on a protected route to be established as the attacker rather than as the user.

Q: What is the practical impact of a successful attack?

Actions the victim performs in that session, such as uploads, form submissions, or account bindings, are applied to the attacker's account. The issue does not directly compromise confidentiality, integrity, or availability of the affected APISIX service according to the provided CVSS vector.

Q: What remediation is available?

Upgrade Apache APISIX to version 3.19.0, which fixes the issue.

Published Oct 1, 2026

Updated

Affected Software

1 affected component

Apache APISIX>=3.17.0<=3.18.0

Frequently Asked Questions

Which deployments are exposed to this issue?

Apache APISIX deployments running versions 3.17.0 through 3.18.0 are affected when they use the feishu-auth or dingtalk-auth plugin on protected routes.

What must an attacker do to exploit it?

The attacker must persuade a user to click a crafted link. Successful exploitation causes the user's browser session on a protected route to be established as the attacker rather than as the user.

What is the practical impact of a successful attack?

Actions the victim performs in that session, such as uploads, form submissions, or account bindings, are applied to the attacker's account. The issue does not directly compromise confidentiality, integrity, or availability of the affected APISIX service according to the provided CVSS vector.

What remediation is available?

Upgrade Apache APISIX to version 3.19.0, which fixes the issue.