medium6.4
CVE-2026-94212
Improper verification of cryptographic signature vulnerability in Apache APISIX.
Impact
Improper verification of cryptographic signature vulnerability in Apache APISIX. Any unauthenticated attacker could impersonate any user on every route protected by the saml-auth plugin under default configuration. This issue affects Apache APISIX: from 3.17.0 through 3.18.0. Users are recommended to upgrade to version 3.19.0, which fixes the issue.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Apache | Apache APISIX: From 3.17.0 | through 3.18.0. |
Versions were read from the advisory text. No structured product data has been published for this record yet.