PT-2026-50898

CVE-2026-49871

Published

2026-06-19

Updated

2026-06-23

Description by

CVSS 3.1

9.4

Critical

MetricsAV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Apache APISIX versions 3.0.0 through 3.16.0

Description A Cross-Site Request Forgery (CSRF) issue exists in the cas-auth plugin under default configurations. This allows a remote attacker to trick a victim into visiting a malicious webpage, causing the victim's browser to be authenticated as a different identity. Consequently, actions performed by the victim are attributed to the attacker's identity.

Recommendations Upgrade to version 3.17.0.

Exploitability

Exploit

Fix

Impacts

Researchers

Lokerxxx

Vendors

Affected products

Weakness enumeration

CWE-352: Cross-Site Request Forgery (CSRF)

Related identifiers