CVE-2026-94276

Apache APISIX 3.12.0 through 3.18.0 has an improper authentication flaw (CWE-287) in the openid-connect plugin when it performs remote token introspection against an authorization server that serves multiple issuers. A token that introspects as active for one issuer can be accepted on a route restricted to a different issuer, so the intended issuer check is not enforced. An attacker who already holds a valid token for one issuer on that shared authorization server may reach routes meant for another issuer; CVSS 4.0 rates this 5.1 (medium), with high subsequent confidentiality and low subsequent integrity impact and no direct impact on the gateway itself. Only deployments using that plugin configuration are affected. No public proof-of-concept is known, and the issue is not in CISA KEV.

What to do: Upgrade Apache APISIX to 3.19.0 or later. Until then, review routes that use the openid-connect plugin with remote introspection against an authorization server that serves more than one issuer, and do not rely on per-route issuer restrictions for access control in that setup.