CVE-2026-44087CWE-345

Apache APISIX: Openid-connect plugin Identity Header Spoofing

Medium · published June 19, 2026

CVSS v4.0
5.3
EPSS
0%
Percentile
19.6
In the wild
Unconfirmed
What it is

Insufficient Verification of Data Authenticity vulnerability in Apache APISIX.

The openid-connect plugin under default configuration has an attack surface that allows the attacker to spoof identity headers allowing the attacker to get unauthorized access the protected resources.

This issue affects Apache APISIX: from 2.3 through 3.16.0.

Users are recommended to upgrade to version 3.17.0, which fixes the issue.

The record
Technical detail
CVSS v4.0
5.3 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N
EPSS
0.00281 · 19.6th percentile
Weakness
CWE-345 · Insufficient Verification of Data Authenticity
Published
2026-06-19T13:11Z
EPSS history
Timeline
  • 19 JUN 13:11Z
    Apache APISIX: Openid-connect plugin Identity Header Spoofing
    cvelistv5