EUVD-2026-22239
GHSA-j648-xxf5-44cv
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
6DescriptionCVE.org
Cleartext Transmission of Sensitive Information vulnerability in Apache APISIX.
This can occur due to ssl_verify in openid-connect plugin configuration being set to false by default. This issue affects Apache APISIX: from 0.7 through 3.15.0.
Users are recommended to upgrade to version 3.16.0, which fixes the issue.
AnalysisAI
Sensitive authentication tokens in Apache APISIX OpenID Connect plugin transmit in cleartext when connecting to identity providers, affecting versions 0.7 through 3.15.0. The ssl_verify parameter defaults to false, disabling TLS certificate validation and enabling potential man-in-the-middle interception of authentication credentials. With CVSS 7.5 (High), network-based attackers can intercept confidential data without authentication. EPSS probability is minimal (0.01%, 2nd percentile) with no confirmed active exploitation (CISA KEV absent), indicating theoretical risk despite high CVSS severity.
Technical ContextAI
Apache APISIX is a cloud-native API gateway built on NGINX and LuaJIT. The vulnerability resides in the openid-connect plugin, which handles OAuth 2.0/OIDC authentication flows between the gateway and identity providers. The root cause (CWE-319: Cleartext Transmission of Sensitive Information) stems from the ssl_verify configuration defaulting to false, disabling TLS certificate verification during HTTPS connections to OIDC providers. When certificate validation is disabled, the plugin accepts any certificate-including those presented by man-in-the-middle attackers-allowing interception of bearer tokens, authorization codes, and client credentials transmitted during authentication handshakes. This affects the trust relationship between APISIX and upstream identity providers across all 0.7.x through 3.15.0 releases spanning multiple years of deployments.
RemediationAI
Upgrade to Apache APISIX version 3.16.0, which changes the ssl_verify default to true and enforces TLS certificate validation in the openid-connect plugin. The Apache Software Foundation advisory at https://lists.apache.org/thread/0pjs72l7qj83j3srw1l1toyj24bsgkds confirms version 3.16.0 as the complete fix. For deployments unable to immediately upgrade, implement the workaround by explicitly setting ssl_verify to true in all openid-connect plugin configurations, ensuring certificate validation occurs for identity provider connections. Review existing plugin instances to identify and remediate configurations with ssl_verify set to false. Additionally, audit network architecture to ensure APISIX-to-IdP communications traverse trusted network segments with traffic inspection capabilities to detect potential man-in-the-middle attempts during the remediation window.
More in Apache Apisix
View allHeader injection in Apache APISIX 2.12.0 through 3.15.0 lets remote attackers smuggle attacker-controlled HTTP headers t
Authentication bypass in Apache APISIX versions 2.2 through 3.16.0 allows remote attackers to circumvent authentication
HMAC authentication replay in Apache APISIX 3.11.0 through 3.16.0 permits remote attackers who have captured a valid hma
Authentication bypass in Apache APISIX's jwe-decrypt plugin (versions 3.8.0 through 3.16.0) allows unauthenticated netwo
Identity header spoofing in Apache APISIX versions 2.12.0 through 3.16.0 allows a low-privileged network attacker to man
Authentication bypass in Apache APISIX 3.0.0 through 3.16.0 allows a network-accessible attacker holding valid credentia
Incorrect authorization in the Apache APISIX authz-casdoor plugin allows a network-authenticated attacker to cross-authe
Identity header spoofing in Apache APISIX's openid-connect plugin (versions 2.3 through 3.16.0) enables low-privileged n
Apache APISIX 2.99.0 through 3.15.0 transmits sensitive log data in cleartext over HTTP when exporting logs to Tencent C
Identity header spoofing in the Apache APISIX OPA (Open Policy Agent) plugin allows low-privileged network attackers to
The wolf-rbac plugin in Apache APISIX 1.2.0 through 3.16.0 trusts client-controlled identity and IP data under its defau
Open redirect in Apache APISIX 3.0.0 through 3.16.0 enables unauthenticated remote attackers to manipulate specific HTTP
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today