EUVD-2026-38023
GHSA-q562-qrm6-7p84
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible with no privileges required, but mandatory user interaction; scope change captures session token exposure on the victim's subsequent system, with low confidentiality and integrity impact.
Primary rating from Vendor (apache).
CVSS VectorVendor: apache
Lifecycle Timeline
1DescriptionCVE.org
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Apache APISIX.
The attacker could manipulate some client headers to perform an open-redirect, to potentially expose the session token.
This issue affects Apache APISIX: from 3.0.0 through 3.16.0.
Users are recommended to upgrade to version 3.17.0, which fixes the issue.
AnalysisAI
Open redirect in Apache APISIX 3.0.0 through 3.16.0 enables unauthenticated remote attackers to manipulate specific HTTP client headers, causing victim users to be redirected to attacker-controlled sites with potential session token leakage. Exploitation requires active user interaction and specific attack conditions (CVSS 4.0 AT:P, UI:A), yielding a vendor-assigned score of 2.1 (Low) - limiting realistic exposure to targeted phishing scenarios rather than opportunistic mass exploitation. No public exploit code or CISA KEV listing exists at time of analysis; the Apache Software Foundation has released a vendor-confirmed fix in version 3.17.0.
Technical ContextAI
Apache APISIX (CPE: cpe:2.3:a:apache_software_foundation:apache_apisix:*:*:*:*:*:*:*:*) is a cloud-native, open-source API gateway that handles HTTP routing, load balancing, authentication, and traffic policy enforcement. The root cause class is CWE-601 (URL Redirection to Untrusted Site), which arises when a gateway or application uses attacker-influenced input - in this case, specific client-controlled HTTP headers such as Host, X-Forwarded-Host, or Referer - as part of redirect logic without strict allowlist validation. Reverse proxies and API gateways are particularly susceptible to this pattern because they are designed to forward and transform headers by default. When redirect destinations are derived from such headers without sanitization, an adversary can substitute a malicious URL, causing the server to emit a Location header pointing to an external attacker-controlled domain. The CVSS 4.0 AT:P (Attack Requirements: Present) metric confirms that a specific configuration or behavioral condition in APISIX must be met for the redirect logic to be influenced by client headers.
RemediationAI
Upgrade Apache APISIX to version 3.17.0, which is the vendor-confirmed fix per the Apache Software Foundation advisory at https://lists.apache.org/thread/yo1kq93ds69zbgjjopop7dmzm7zhj1gq. If an immediate upgrade is not possible, apply the following compensating controls: restrict or disable any APISIX plugins or route configurations that perform header-driven redirects, and enforce strict allowlisting of acceptable Host and forwarding headers at the APISIX configuration level to prevent external domain injection. Additionally, deploying a WAF rule that blocks HTTP responses containing Location headers pointing to domains outside an approved allowlist can intercept the redirect before it reaches the victim browser, though this may interfere with legitimate OAuth or SSO redirect flows and should be tested carefully in staging before production rollout. There are no known side effects to the 3.17.0 upgrade specific to this fix.
More in Open Redirect
View allA malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL ca
GFI Kerio Control versions 9.2.5 through 9.4.5 contain an HTTP response splitting vulnerability in the dest parameter of
PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect
Multiple open redirect vulnerabilities in Apache Struts 2.0.0 through 2.3.15 allow remote attackers to redirect users to
Open redirect vulnerability in age-verification.php in the Age Verification plugin 0.4 and earlier for WordPress allows
Open redirect vulnerability in Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.29, 8.x before 8.0.0.18, 9.0 b
Vulnerability in the Oracle Applications Framework component of Oracle E-Business Suite (subcomponent: Popup windows (li
Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware 10.1.4.3
Flarum is open source discussion platform software. Rated medium severity (CVSS 6.5), this vulnerability is remotely exp
Open redirect vulnerability in Novius OS 5.0.1 (Elche) allows remote attackers to redirect users to arbitrary web sites
Open redirect vulnerability in the Redirect function in stageshow_redirect.php in the StageShow plugin before 5.0.9 for
Nteract v.0.28.0 was discovered to contain a remote code execution (RCE) vulnerability via the Markdown link. Rated crit
Share
External POC / Exploit Code
Leaving vuln.today