CVE-2026-94276: Apache APISIX Openid-Connect Introspection Validation Issue
Summary
CVE-2026-94276: Apache APISIX: Openid-connect introspection validation issue. Affects apisix versions >= 3.12.0, < 3.19.0. Fixed in 3.19.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache APISIX is an open-source API gateway that provides a range of features for managing APIs, including traffic management, security, and observability. It supports various plugins to extend its functionality, one of which is the Openid-connect plugin. This plugin allows for authentication and authorization using OpenID Connect, a widely adopted identity layer on top of the OAuth 2.0 protocol. However, a vulnerability has been identified in the way APISIX handles token introspection when multiple issuers are involved, potentially leading to improper authentication.
Vulnerability Detail
The vulnerability arises from an improper authentication mechanism in Apache APISIX when using the Openid-connect plugin with remote introspection against an authorization server that serves multiple issuers. Specifically, a token that is validated as active for one issuer may be incorrectly accepted on a route that is restricted to another issuer. This could allow unauthorized access to resources, posing a significant security risk. The issue affects versions from 3.12.0 through 3.18.0, making it crucial for users to upgrade to the fixed version to mitigate this risk.
How To Fix
Minimum fixed version
3.19.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can restrict access to routes by implementing additional authorization checks or by limiting the use of the Openid-connect plugin until the upgrade can be performed. However, this is not a permanent solution and upgrading is strongly recommended.
Conclusion
In summary, CVE-2026-94276 is a significant vulnerability in Apache APISIX that can lead to improper authentication due to issues with token introspection across multiple issuers. Users are strongly advised to upgrade to version 3.19.0 or later to mitigate this risk. Temporary workarounds can be implemented, but they are not substitutes for a proper upgrade.
See every vulnerability recorded for apisix →
FAQ
CVE-2026-94276 is a vulnerability in Apache APISIX that allows improper authentication due to issues with token introspection when multiple issuers are involved.
The vulnerability affects Apache APISIX versions from 3.12.0 to 3.18.0.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If an immediate upgrade is not possible, consider implementing additional authorization checks or temporarily disabling the Openid-connect plugin.
More information can be found in the official Apache APISIX documentation and the vulnerability database linked in the details.
Related vulnerabilities
Recent vulnerabilities recorded for apisix.
