CVE-2026-94276: Apache APISIX: Openid-connect introspection validation issue
Apache APISIX versions 3.12.0–3.18.0 can accept a token introspected as active for the wrong issuer.
CVE-2026-94276 is an improper authentication flaw in Apache APISIX’s openid-connect plugin, scored CVSS 4.0 5.1 (medium). Affected releases are 3.12.0 through 3.18.0. When remote introspection is used against an authorization server that hosts multiple issuers, a token active for one issuer may be accepted on a route meant for another. The advisory rates subsequent confidentiality as high and integrity as low, and does not describe exploitation.
- CVE-2026-94276 affects Apache APISIX 3.12.0 through 3.18.0.
- OpenID Connect remote introspection can confuse tokens across issuers.
- CVSS 4.0 base score is 5.1, with high subsequent confidentiality impact.
- No in-the-wild exploitation is reported in the advisory.
- CVEs
- CVE-2026-94276
- Vendors
- Apache Software Foundation
- Products
- Apache APISIX
- Organizations
- Apache Software Foundation
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-94276 | Improper Authentication in Apache APISIX OpenID-Connect | 5.1 | — |
From the original article
Posted by Abhishek Choudhary on Oct 01 Severity: CVSS 4. 0: 5. 1 (medium) CVSS:4.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.