CVE-2026-31923 — Apache APISIX: Openid-connect `tls_verify` field is disabled by default

CVE-2026-31923

Apache APISIX: Openid-connect `tls_verify` field is disabled by default PUBLISHED

Description (CNA)

Cleartext Transmission of Sensitive Information vulnerability in Apache APISIX. This can occur due to `ssl_verify` in openid-connect plugin configuration being set to false by default. This issue affects Apache APISIX: from 0.7 through 3.15.0. Users are recommended to upgrade to version 3.16.0, which fixes the issue.

Affected (CNA)

Vendor / product	Versions
Apache Software Foundation / Apache APISIX	affected 0.7 through 3.15.0

CWE

CWE-319

References

https://lists.apache.org/thread/0pjs72l7qj83j3srw1l1toyj24bsgkds

ADP enrichment

CVE

No English description supplied.

http://www.openwall.com/lists/oss-security/2026/04/14/1

CISA-ADP

No English description supplied.

No references supplied.