Apache Software Foundation

apisix/batch-requests plugin allows overwriting the X-REAL-IP header

Apache APISIX: the body_schema check in request-validation plugin can be bypassed

Apache APISIX: cas-auth login CSRF / session injection issue

Apache APISIX: JWT Algorithm Confusion allows authentication bypass

Apache APISIX: forward auth plugin allows header injection

Apache APISIX: Authentication bypass in jwe-decrypt

Apache APISIX: Openid-connect plugin Identity Header Spoofing

Apache APISIX: attach-consumer-label does not strip client-supplied consumer-label headers

Apache APISIX: Identity Injection via forward-auth Plugin Missing Header Cleanup

Apache APISIX: Unauthenticated CPU-exhaustion DoS

Apache APISIX: ldap-auth plugin cross-subtree identity impersonation

Apache APISIX: Improper authentication in cas-auth plugin

Apache APISIX: authz-casdoor incorrect session sharing

Apache APISIX Java Plugin Runner: Local listening file permissions in APISIX plugin runner allow a local attacker to elevate privileges

The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

Path traversal in request_uri variable

apisix/jwt-auth may leak secrets in error response

Apache APISIX: Cross-user response poisoning in serverless plugins

Apache APISIX: basic-auth logs plaintext credentials at info level

Apache APISIX: Openid-connect `tls_verify` field is disabled by default

Apache APISIX: Cas-auth Host header influence on CAS service URL

In Apache APISIX, the user enabled the Admin API and deleted the Admin API access IP restriction rules. Eventually, the default token is allowed to access APISIX management data. This affects versions 1.2, 1.3, 1.4, 1.5.

Apache APISIX: Session replay issue in hmac-auth

Apache APISIX: Forward-Auth Request Smuggling

Apache APISIX: Cas-auth plugin open redirect via unsanitized cookie value

Apache APISIX: wolf-rbac plugin Identity Spoofing

Apache APISIX: Identity spoofing issue in APISIX opa plugin

Apache APISIX: improper validation of issuer from introspection discovery url in plugin openid-connect

Apache APISIX: Plugin tencent-cloud-cls log export uses plaintext HTTP