EUVD-2026-38025
GHSA-rrqp-g94p-gmh7
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Victim must actively visit attacker's page during a CAS flow (AC:H, UI:R); only downstream identity integrity is affected, triggering scope change (S:C, I:L).
Primary rating from Vendor (apache).
CVSS VectorVendor: apache
Lifecycle Timeline
1DescriptionCVE.org
Cross-Site Request Forgery (CSRF) vulnerability in the cas-auth plugin under default configurations.
This defect allows a remote attacker that manages to send a victim to a webpage controlled by them can cause the victim's browser to become authenticated as a different identity.
Actions the victim takes upstream are then attributed to attackers identity.
This issue affects Apache APISIX: from 3.0.0 through 3.16.0.
Users are recommended to upgrade to version 3.17.0, which fixes the issue.
AnalysisAI
The cas-auth plugin in Apache APISIX 3.0.0-3.16.0 enables identity substitution via CSRF under its default configuration. An attacker who lures a victim to an attacker-controlled webpage can cause the victim's browser to complete a CAS authentication handshake as the attacker's identity within the APISIX gateway. Subsequent API gateway actions performed by the victim are then recorded and authorized under the attacker's account, creating audit trail corruption and potential authorization abuse. No public exploit code exists and this CVE is not listed in CISA KEV at time of analysis.
Technical ContextAI
Apache APISIX is an open-source, cloud-native API gateway built on OpenResty/NGINX, widely used as an ingress and API management layer. The cas-auth plugin integrates CAS (Central Authentication Service) single sign-on into APISIX's authentication pipeline. CWE-352 (Cross-Site Request Forgery) manifests here because the CAS callback or redirect flow processed by the plugin does not validate that the authentication request originated from the legitimate user's own session - there is no CSRF token or state parameter check protecting the CAS redirect. This allows a third-party webpage to trigger or co-opt the CAS handshake in the victim's browser context. The affected CPE is cpe:2.3:a:apache_software_foundation:apache_apisix:*:*:*:*:*:*:*:*, covering versions 3.0.0 through 3.16.0.
RemediationAI
The primary remediation is to upgrade Apache APISIX to version 3.17.0, which resolves the CSRF flaw in the cas-auth plugin, as confirmed by the Apache Software Foundation advisory at https://lists.apache.org/thread/1ozsnss0lof4gpwq763d66oxwxt3sycp. If an immediate upgrade is not operationally feasible, disabling the cas-auth plugin and substituting an alternative authentication plugin (such as key-auth or jwt-auth) eliminates the vulnerable code path, though it will break CAS/SSO workflows for end users. A secondary compensating control is to enforce a CSRF-protective state parameter in the CAS redirect flow via APISIX's custom plugin or middleware layer; this requires development effort and testing before deployment. Network-layer restrictions that limit which origins can initiate authentication callbacks to APISIX may reduce exposure but are not a complete mitigation given the browser-side nature of CSRF.
More in Apache Apisix
View allHeader injection in Apache APISIX 2.12.0 through 3.15.0 lets remote attackers smuggle attacker-controlled HTTP headers t
Sensitive authentication tokens in Apache APISIX OpenID Connect plugin transmit in cleartext when connecting to identity
Authentication bypass in Apache APISIX versions 2.2 through 3.16.0 allows remote attackers to circumvent authentication
HMAC authentication replay in Apache APISIX 3.11.0 through 3.16.0 permits remote attackers who have captured a valid hma
Authentication bypass in Apache APISIX's jwe-decrypt plugin (versions 3.8.0 through 3.16.0) allows unauthenticated netwo
Identity header spoofing in Apache APISIX versions 2.12.0 through 3.16.0 allows a low-privileged network attacker to man
Authentication bypass in Apache APISIX 3.0.0 through 3.16.0 allows a network-accessible attacker holding valid credentia
Incorrect authorization in the Apache APISIX authz-casdoor plugin allows a network-authenticated attacker to cross-authe
Identity header spoofing in Apache APISIX's openid-connect plugin (versions 2.3 through 3.16.0) enables low-privileged n
Apache APISIX 2.99.0 through 3.15.0 transmits sensitive log data in cleartext over HTTP when exporting logs to Tencent C
Identity header spoofing in the Apache APISIX OPA (Open Policy Agent) plugin allows low-privileged network attackers to
The wolf-rbac plugin in Apache APISIX 1.2.0 through 3.16.0 trusts client-controlled identity and IP data under its defau
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today