CVE-2026-94220: Apache APISIX: session fixation issue in feishu-auth and dingtalk-auth plugin
Apache APISIX feishu-auth and dingtalk-auth allow session fixation through a crafted link (CVE-2026-94220).
24
Vulnerability6 · 2 reads
CVE-2026-94220
CSRF session fixation in Apache APISIX Feishu and DingTalk auth
- CVSS 4.0
- 2.1 low
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
Apache APISIX 3.17.0 through 3.18.0 has a cross-site request forgery flaw (CWE-352) in the feishu-auth and dingtalk-auth plugins that can fix a browser session to an attacker's identity. An attacker must get a user to open a crafted link; that user's session on a protected route is then established as the attacker rather than the user. Later work in that session, including uploads, form submissions, and account bindings, is recorded against the attacker's account. Only sites running those two plugins on the stated releases are affected. No public proof of concept is known, and the issue is not listed in CISA KEV.
What to do: Upgrade Apache APISIX to 3.19.0, which fixes this issue. Until the upgrade is in place, disable the feishu-auth and dingtalk-auth plugins if they are not required, and review protected routes for sessions or account bindings that do not match the expected user.
| Product | Affected |
|---|---|
| Apache APISIX (feishu-auth and dingtalk-auth plugins) | 3.17.0 through 3.18.0 |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Cross-Site request forgery (CSRF) vulnerability in feishu-auth and dingtalk-auth plugins in Apache APISIX. An attacker who can get a user to click a crafted link may cause that user's browser session on a protected route to be established under the attacker's identity instead of their own. Any work the user then performs in that session, including uploads, form submissions, and account bindings, lands in the attacker's account. This issue affects Apache APISIX: from 3.17.0 through 3.18.0. Users are recommended to upgrade to version 3.19.0, which fixes the issue.
- Weakness
- CWE-352
- Vector
- CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X