CVE-2026-49871— Apache APISIX: cas-auth login CSRF / session injection issue
Quick assessment
Affected
Apache Software Foundation Apache APISIX
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Apache apisix是美国Apache基金会开源的一个动态API网关服务。 Apache APISIX 3.0.0版本至3.16.0版本存在跨站请求伪造漏洞，该漏洞源于默认配置下的cas-auth plugin存在跨站请求伪造，可能导致远程攻击者诱使受害者访问恶意网页，使受害者浏览器以不同身份被认证，从而将用户的操作归因于攻击者身份。
Possible ATT&CK Techniques 3 AI
T1133 · External Remote Services T1078 · Valid Accounts T1189 · Drive-by CompromiseAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Apache Software Foundation | Apache APISIX | 3.0.0≤ 3.16.0 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-49871
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Apache APISIX: cas-auth login CSRF / session injection issue
Source: CVE Program / CVE List V5
Vulnerability Description
Cross-Site Request Forgery (CSRF) vulnerability in the cas-auth plugin under default configurations.
This defect allows a remote attacker that manages to send a victim to a webpage controlled by them can cause the victim's browser to become authenticated as a different identity.
Actions the victim takes upstream are then attributed to attackers identity.
This issue affects Apache APISIX: from 3.0.0 through 3.16.0.
Users are recommended to upgrade to version 3.17.0, which fixes the issue.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
跨站请求伪造(CSRF)
Source: CVE Program / CVE List V5
Vulnerability Title
Apache apisix 跨站请求伪造漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Apache apisix是美国Apache基金会开源的一个动态API网关服务。 Apache APISIX 3.0.0版本至3.16.0版本存在跨站请求伪造漏洞，该漏洞源于默认配置下的cas-auth plugin存在跨站请求伪造，可能导致远程攻击者诱使受害者访问恶意网页，使受害者浏览器以不同身份被认证，从而将用户的操作归因于攻击者身份。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Apache Software Foundation | Apache APISIX | 3.0.0 ~ 3.16.0 | - |
|
II. Public POCs for CVE-2026-49871
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-49871
请登录查看更多情报信息。
Mailing List Discussions for CVE-2026-49871 (1)
Same Patch Batch · Apache Software Foundation · 2026-06-19 · 12 CVEs total
| CVE-2026-39998 | Apache APISIX: Identity Injection via forward-auth Plugin Missing Header Cleanup | |
| CVE-2026-39999 | Apache APISIX: JWT Algorithm Confusion allows authentication bypass | |
| CVE-2026-44046 | Apache APISIX: wolf-rbac plugin Identity Spoofing | |
| CVE-2026-47339 | Apache APISIX: authz-casdoor incorrect session sharing | |
| CVE-2026-44087 | Apache APISIX: Openid-connect plugin Identity Header Spoofing | |
| CVE-2026-44915 | Apache APISIX: Cas-auth plugin open redirect via unsanitized cookie value | |
| CVE-2026-49230 | Apache APISIX: Authentication bypass in jwe-decrypt | |
| CVE-2026-49231 | Apache APISIX: Identity spoofing issue in APISIX opa plugin | |
| CVE-2026-48895 | Apache APISIX: Cas-auth Host header influence on CAS service URL | |
| CVE-2026-47341 | Apache APISIX: Session replay issue in hmac-auth | |
| CVE-2026-49872 | Apache APISIX: Improper authentication in cas-auth plugin |
IV. Related Vulnerabilities
Same product: Apache APISIX
-
CVE-2026-94276
Apache APISIX: Openid-connect introspection validation issue -
CVE-2026-94269
Apache APISIX: Servlet-style normalization creates a route/u -
CVE-2026-94250
Apache APISIX: Batch response aggregation can exhaust worker -
CVE-2026-94220
Apache APISIX: session fixation issue in feishu-auth and din -
CVE-2026-94212
Apache APISIX: unauthenticated impersonation issue in saml-a
Same vendor: Apache Software Foundation
-
CVE-2026-113582
Apache Abdera: XML external entity expansion in Atom documen -
CVE-2026-103634
Apache DataSketches: datasketches-cpp: Out-of-bounds read an -
CVE-2026-112381
Apache Traffic Server: Nullptr dereference in net_write_io o -
CVE-2026-111817
Apache Traffic Server: Dropping chunked trailers stalls a pa -
CVE-2026-111812
Apache Traffic Server: origin_server_auth signs client-contr
Same weakness: CWE-352
-
CVE-2026-115796
Tenda F6 Web Management cross-site request forgery -
CVE-2026-93631
Zimbra Collaboration Suite OAuth Extension Cross-Site Reques -
CVE-2026-115494
CSRF protection could be tricked by forged X-Forwarded-Host -
CVE-2026-114177
WordPress Xpro Elementor Addons plugin <= 1.7.10 - Cross Sit -
CVE-2026-114662
Obot before 0.26.0 API Key Theft via CLI Login Token Request
V. Comments for CVE-2026-49871
No comments yet