CVE-2026-94212: Apache APISIX: unauthenticated impersonation issue in saml-auth
Default Apache APISIX saml-auth lets unauthenticated attackers impersonate any user (CVE-2026-94212).
58
Vulnerability2 · 1 read
CVE-2026-94212
Signature verification flaw enables impersonation in Apache APISIX
- CVSS 4.0
- 6.4 medium
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
Apache APISIX 3.17.0 through 3.18.0 improperly verifies cryptographic signatures in the saml-auth plugin (CWE-347). Under that plugin’s default configuration, an unauthenticated remote attacker can impersonate any user on every route the plugin protects. The practical impact is on applications behind the gateway, where subsequent-system confidentiality and integrity can be compromised, rather than on the gateway process itself. Only installations in that version range that actually use saml-auth with default settings are affected. The flaw is fixed in 3.19.0; it is not in CISA KEV and no public proof-of-concept is known.
What to do: Upgrade Apache APISIX to 3.19.0, which the vendor states fixes the issue. Until then, find every route using the saml-auth plugin on 3.17.0–3.18.0 with default settings and treat those identities as forgeable; review access logs for unexpected user impersonation and avoid leaving that plugin on internet-facing routes if you cannot upgrade immediately.
| Product | Affected |
|---|---|
| Apache APISIX | 3.17.0 through 3.18.0 |
Estimated exposure
nichelow thousands of deployments at most (saml-auth on 3.17.0–3.18.0 only) — No install count or internet-scan total is in the advisory; the figure is an order-of-magnitude inference from APISIX’s open-source API-gateway adoption, narrowed to only the 3.17.0–3.18.0 releases and only deployments that enable the…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Improper verification of cryptographic signature vulnerability in Apache APISIX. Any unauthenticated attacker could impersonate any user on every route protected by the saml-auth plugin under default configuration. This issue affects Apache APISIX: from 3.17.0 through 3.18.0. Users are recommended to upgrade to version 3.19.0, which fixes the issue.
- Weakness
- CWE-347
- Vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X