Apache APISIX CVE-2026-94212

Requires the target Apache APISIX gateway to run an affected version (3.17.0 through 3.18.0) with the saml-auth plugin enabled on one or more routes - notably the DEFAULT configuration of this plugin is vulnerable, so no additional misconfiguration is needed. Exploitation is unauthenticated and requires no user interaction per the description (though the vendor's CVSS 4.0 vector states PR:L, a conflict to verify). Limiting factors: the narrow version window (only two minor releases) and the fact that only routes actually protected by saml-auth are affected; deployments not using saml-auth, or already on 3.19.0+, are not exposed.

This is a genuine high-priority authentication-bypass issue despite the moderate 6.4 vendor score. The description explicitly states an UNAUTHENTICATED attacker can impersonate ANY user on EVERY route protected by the saml-auth plugin under DEFAULT configuration - a complete SAML SSO authentication bypass via improper cryptographic signature verification (CWE-347). This conflicts with the vendor CVSS 4.0 vector, which uses PR:L (attacker needs some privilege); the prose clearly describes PR:N, so the vendor vector likely understates reach - verify with Apache. The vendor also scores impact only on the subsequent system (VC/VI/VA:N on the gateway but SC:H/SI:H on the protected upstreams), which is reasonable for a gateway but, combined with PR:L, pulls the 4.0 score down to 6.4; a PR:N impersonation of arbitrary users (potentially including privileged accounts) on protected backends is materially more severe. No EPSS score, no CISA KEV listing, and no public exploit were provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The narrow affected window (only 3.17.0 through 3.18.0) limits the exposed population, but the 'default configuration' qualifier means vulnerable deployments need no special misconfiguration - any affected version running saml-auth is exposed.

An unauthenticated attacker targets an APISIX gateway (3.17.0-3.18.0) that fronts applications using the saml-auth plugin for SSO. Because the plugin does not properly verify the SAML assertion's cryptographic signature, the attacker forges or tampers with a SAML response to assert any identity and is granted an authenticated session for that user on every protected route, gaining the victim's access to upstream applications. No public exploit code was provided, and exploitation requires no authentication and no user interaction per the description.