https://seclists.org/oss-sec/2026/q4/7: CVE-2026-94276: Apache APISIX: Openid-connect introspection validation issue

Q: Which deployments are exposed to this issue?

Apache APISIX 3.12.0 through 3.18.0 is affected when a route uses the openid-connect plugin with remote token introspection against an authorization server serving multiple issuers.

Q: What would an attacker need to exploit it?

An attacker would need a token that the authorization server introspects as active for one issuer. The vulnerable route must be restricted to a different issuer while using that same multi-issuer authorization server for remote introspection.

Q: Are all APISIX routes affected by default?

No. The issue is limited to routes configured with the openid-connect plugin and remote introspection in the described multi-issuer authorization-server scenario.

Q: What is the recommended remediation?

Upgrade Apache APISIX to version 3.19.0, which fixes the issue.

Published Oct 1, 2026

Updated

Affected Software

1 affected component

Apache APISIX>=3.12.0<=3.18.0

Frequently Asked Questions

Which deployments are exposed to this issue?

Apache APISIX 3.12.0 through 3.18.0 is affected when a route uses the openid-connect plugin with remote token introspection against an authorization server serving multiple issuers.

What would an attacker need to exploit it?

An attacker would need a token that the authorization server introspects as active for one issuer. The vulnerable route must be restricted to a different issuer while using that same multi-issuer authorization server for remote introspection.

Are all APISIX routes affected by default?

No. The issue is limited to routes configured with the openid-connect plugin and remote introspection in the described multi-issuer authorization-server scenario.

What is the recommended remediation?

Upgrade Apache APISIX to version 3.19.0, which fixes the issue.