Apache APISIX EUVD-2026-90766

Requires that the feishu-auth or dingtalk-auth plugin be configured and active on a protected route of the APISIX gateway (3.17.0-3.18.0) - organizations not using Feishu or DingTalk OAuth login are unaffected. Exploitation is further gated by deliberate victim interaction (UI:A: the target must click an attacker-crafted link) and by the attack requirement (AT:P) that the attacker first obtain a valid login artifact tied to their own identity. Material impact only occurs if the victim then performs sensitive actions (uploads, form submissions, account bindings) inside the attacker-bound session; a victim who merely loads the link without acting suffers little. These user-interaction and plugin-configuration limits substantially constrain realistic exploitation.

This is a low-real-risk issue despite being network-reachable. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N, base 2.1) is internally consistent with a classic login-CSRF/session-fixation weakness: the vulnerable system (the APISIX gateway) suffers no direct confidentiality, integrity, or availability loss (VC:N/VI:N/VA:N), and the only impact falls on a subsequent system - the downstream application/account - at low severity (SC:L/SI:L). The AT:P (attack requirement) and UI:A (active, deliberate victim interaction with a crafted link) metrics both heavily discount the score, correctly reflecting that the attacker must lure a victim into clicking and the victim must then actually perform meaningful work inside the attacker-bound session for impact to materialize. No EPSS score, no CISA KEV listing, and no public exploit were provided, so there is no public exploit identified at time of analysis and no evidence of active or widespread exploitation. Note a cross-version scoring discrepancy: a CVSS 3.1 representation of the same login-CSRF with scope change (S:C, C:L/I:L) would land around 6.1 (medium), materially higher than the 4.0 score of 2.1, because 3.1's scope mechanism inflates subsequent-system impact relative to 4.0 - teams comparing against 3.1-scored CVEs should not be misled by the low 4.0 number. The affected plugins (feishu-auth, dingtalk-auth) narrow the exposed population further.

An attacker initiates an OAuth/login flow via the feishu-auth or dingtalk-auth plugin and captures the resulting authorization artifact bound to the attacker's own identity, then embeds it in a crafted link. The attacker social-engineers a legitimate user into clicking it; because the login callback lacks CSRF protection (state/anti-forgery token), the victim's browser establishes a session on the protected route under the attacker's account. Any uploads, form submissions, or account bindings the victim subsequently performs land in the attacker's account. No public exploit code was identified at time of analysis.