CVE-2026-94220CWE-352csrf

CVE-2026-94220

published October 1, 2026

CVSS
2.1
EPSS
0%
Percentile
12.2
In the wild
Unconfirmed
What it is

Cross-Site request forgery (CSRF) vulnerability in feishu-auth and dingtalk-auth plugins in Apache APISIX.

An attacker who can get a user to click a crafted link may cause that user's browser session on a protected route to be established under the attacker's identity instead of their own. Any work the user then performs in that session, including uploads, form submissions, and account bindings, lands in the attacker's account. This issue affects Apache APISIX: from 3.17.0 through 3.18.0.

Users are recommended to upgrade to version 3.19.0, which fixes the issue.

The record
Technical detail
CVSS
2.1 · NONE
CVSS v4.0
2.1 · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
EPSS
0.00223 · 12.2th percentile
Weakness
CWE-352 · Cross-Site Request Forgery (CSRF)
Published
2026-10-01T16:17Z
References (2)
https://lists.apache.org/thread.html/bf5q45ddyr2hf3hxkt56dzjlttgpdg78 · [email protected]http://www.openwall.com/lists/oss-security/2026/10/01/5 · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 03 OCT 03:47Z
    EPSS moved — → 0%
    epss
  • 01 OCT 11:01Z
    Apache APISIX: session fixation issue in feishu-auth and dingtalk-auth plugin
    cvelistv5