CVE-2026-94220: Apache APISIX: session fixation issue in feishu-auth and dingtalk-auth plugin
Apache APISIX feishu-auth and dingtalk-auth allow session fixation through a crafted link (CVE-2026-94220).
CVE-2026-94220 is a low-severity session-fixation issue, CVSS 4.0 2.1, in Apache APISIX 3.17.0 through 3.18.0. The feishu-auth and dingtalk-auth plugins are affected and are described as a cross-site request forgery flaw. An attacker who gets a user to open a crafted link may cause that user's browser session on a protected route to be established under the attacker. User interaction is required, and exploitation is not reported.
- CVE-2026-94220 is rated CVSS 4.0 2.1 (low).
- Affects Apache APISIX 3.17.0 through 3.18.0.
- feishu-auth and dingtalk-auth are vulnerable to session fixation.
- A victim must open a crafted link for the attack.
- CVEs
- CVE-2026-94220
- Vendors
- Apache Software Foundation
- Products
- Apache APISIX
- Organizations
- Apache Software Foundation
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-94220 | CSRF session fixation in Apache APISIX Feishu and DingTalk auth | 2.1 | — |
From the original article
Posted by Abhishek Choudhary on Oct 01 Severity: CVSS 4. 0: 2. 1 (low) CVSS:4.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.