Executive brief
Apache APISIX, a popular cloud-native API gateway, contains a security flaw in its CAS authentication plugin. This vulnerability allows attackers to redirect users from a legitimate company URL to a malicious website. This technique is commonly used in phishing campaigns to trick employees into providing their login credentials on a fake site that looks official.
Technical details
An Open Redirect vulnerability (CWE-601) exists in the default configuration of the cas-auth plugin in Apache APISIX. The flaw stems from the use of unsanitized cookie values during the authentication flow, allowing a remote attacker to craft a URL that redirects a victim to an arbitrary external domain. While the redirect itself does not grant direct access to the gateway, it is a primary vector for phishing attacks and credential harvesting. The issue is present in versions 3.0.0 through 3.16.0 and is resolved in version 3.17.0.
Affected products
- Apache APISIX 3.0.0 through 3.16.0
Timeline
- 2026-06-19: disclosed
- 2026-06-19: advisory
- 2026-06-19: patched: Fixed in version 3.17.0