Executive brief
Apache APISIX, a popular cloud-native API gateway, is vulnerable to a security flaw that allows attackers to redirect users to malicious websites. By manipulating specific web request headers, an attacker can trick the system into sending a user to an untrusted site, which could lead to the theft of sensitive session tokens. This could allow an attacker to impersonate legitimate users and gain unauthorized access to protected applications.
Technical details
An open redirect vulnerability (CWE-601) exists in Apache APISIX versions 3.0.0 through 3.16.0. The flaw is rooted in the 'cas-auth' plugin where the 'Host' header can influence the CAS service URL. A remote, unauthenticated attacker can manipulate client headers to force the gateway to redirect a user's browser to an arbitrary external domain. This redirection can be leveraged to leak sensitive session tokens or facilitate phishing attacks. The issue is resolved in version 3.17.0.
Affected products
- Apache APISIX 3.0.0 through 3.16.0
Timeline
- 2026-06-19: disclosed
- 2026-06-19: advisory
- 2026-06-19: patched: Fixed in version 3.17.0