CVE-2026-48895CWE-601

Apache APISIX: Cas-auth Host header influence on CAS service URL

Low · published June 19, 2026

CVSS v4.0
2.1
EPSS
1%
Percentile
50.3
In the wild
Unconfirmed
What it is

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Apache APISIX.

The attacker could manipulate some client headers to perform an open-redirect, to potentially expose the session token.

This issue affects Apache APISIX: from 3.0.0 through 3.16.0.

Users are recommended to upgrade to version 3.17.0, which fixes the issue.

The record
Technical detail
CVSS v4.0
2.1 · LOW
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
EPSS
0.00646 · 50.3th percentile
Weakness
CWE-601 · URL Redirection to Untrusted Site ('Open Redirect')
Published
2026-06-19T13:16Z
EPSS history
Timeline
  • 19 JUN 13:16Z
    Apache APISIX: Cas-auth Host header influence on CAS service URL
    cvelistv5