CVE-2026-94212CWE-347

CVE-2026-94212

published October 1, 2026

CVSS
6.4
EPSS
0%
Percentile
17.4
In the wild
Unconfirmed
What it is

Improper verification of cryptographic signature vulnerability in Apache APISIX.

Any unauthenticated attacker could impersonate any user on every route protected by the saml-auth plugin under default configuration. This issue affects Apache APISIX: from 3.17.0 through 3.18.0.

Users are recommended to upgrade to version 3.19.0, which fixes the issue.

The record
Technical detail
CVSS
6.4 · NONE
CVSS v4.0
6.4 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N
EPSS
0.00265 · 17.4th percentile
Weakness
CWE-347 · Improper Verification of Cryptographic Signature
Published
2026-10-01T16:17Z
References (2)
https://lists.apache.org/thread.html/1230fnojnmc7bfz3n0nkt7tkcld9d1sc · [email protected]http://www.openwall.com/lists/oss-security/2026/10/01/4 · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 03 OCT 03:47Z
    EPSS moved — → 0%
    epss
  • 01 OCT 11:01Z
    Apache APISIX: unauthenticated impersonation issue in saml-auth
    cvelistv5