CVE-2026-44087 — Apache APISIX: Openid-connect plugin Identity Header Spoofing

CVE-2026-44087

Apache APISIX: Openid-connect plugin Identity Header Spoofing PUBLISHED

Description (CNA)

Insufficient Verification of Data Authenticity vulnerability in Apache APISIX. The openid-connect plugin under default configuration has an attack surface that allows the attacker to spoof identity headers allowing the attacker to get unauthorized access the protected resources. This issue affects Apache APISIX: from 2.3 through 3.16.0. Users are recommended to upgrade to version 3.17.0, which fixes the issue.

Affected (CNA)

Vendor / product	Versions
Apache Software Foundation / Apache APISIX	affected 2.3 through 3.16.0

CWE

CWE-345

References

https://lists.apache.org/thread/72ryrgdssk6s2x9d6xn14bxyyl878xfm

ADP enrichment

CVE

No English description supplied.

http://www.openwall.com/lists/oss-security/2026/06/19/7

CISA-ADP

No English description supplied.

No references supplied.