CVE-2026-44915: Apache APISIX CAS Open Redirect Vulnerability (CVSS 6.1)

Technical summary

CVE-2026-44915 is a CWE-601 open redirect flaw in Apache APISIX's CAS (Central Authentication Service) authentication handler. The default configuration fails to properly validate redirect URLs, allowing attackers to inject arbitrary redirect targets into the authentication flow. When users complete CAS authentication, the application redirects them to an attacker-controlled URL without validation. The vulnerability has a CVSS 3.1 score of 6.1 (MEDIUM), reflecting the requirement for user interaction and the limited direct impact—attackers gain a foothold for credential harvesting and phishing but cannot directly compromise application confidentiality or integrity through the redirect alone.

Business impact

Open redirect vulnerabilities in authentication flows pose a significant social engineering risk. Attackers can weaponize legitimate-looking authentication workflows to steal credentials or session tokens, effectively bypassing user trust in your authentication infrastructure. For organizations deploying APISIX as an API gateway or authentication layer, a successful attack could compromise user accounts, enable lateral movement into downstream services, and damage customer trust. Regulatory and compliance implications may arise if customer data is accessed through compromised credentials.

Affected systems

Apache APISIX versions 3.0.0 through 3.16.0 are affected when CAS authentication is configured. The vulnerability is not present in version 3.17.0 and later. Organizations using other APISIX authentication plugins (OAuth2, JWT, etc.) are not directly affected, but those relying on CAS authentication or considering its deployment should prioritize immediate action.

Exploitability

The vulnerability requires user interaction—a victim must click a malicious link that includes crafted parameters to trigger the open redirect. No authentication bypass or privilege escalation is required; the attacker simply manipulates the post-authentication redirect target. The attack surface is broad in internet-facing deployments where users access applications protected by APISIX. However, internal or intranet-only deployments face lower risk if users are trained to scrutinize URLs. The CVSS vector (AV:N/AC:L/PR:N/UI:R) confirms the network-accessible, low-complexity nature of the attack.

Remediation

Upgrade Apache APISIX to version 3.17.0 or later, which implements URL validation for redirect targets in the CAS authentication handler. Organizations unable to upgrade immediately should review CAS configuration settings and, where possible, implement additional URL whitelisting policies at the application or WAF level. Disable CAS authentication if it is not actively used. Monitor authentication logs for suspicious redirect patterns or unusual post-authentication navigation.

Patch guidance

Verify the current version of Apache APISIX in your environment and plan a controlled upgrade to version 3.17.0 or later. Review the Apache APISIX release notes and security advisories for any breaking changes or migration guidance. Test the upgrade in a staging environment that mirrors production authentication flows, including CAS-based login workflows. For clustered deployments, coordinate the upgrade to minimize service interruption. After patching, validate that CAS authentication continues to function correctly and that legitimate redirects complete as expected.

Detection guidance

Monitor authentication logs for redirect parameters containing suspicious domains or IP addresses. Review HTTP referrer logs and POST-authentication redirect targets for URLs pointing outside your organization's domain. Configure alerts on CAS authentication endpoints when the redirect parameter (typically 'service' or 'redirect_uri') contains unexpected hosts. Analyze user sessions for patterns consistent with credential phishing, such as immediate password changes or access from unusual locations shortly after authentication. SIEM rules should flag redirect parameters containing encoded or obfuscated URLs, which are common in social engineering attacks.

Why prioritize this

Although the CVSS score is MEDIUM, the vulnerability directly impacts your authentication infrastructure and enables credential theft at scale. The low attack complexity and lack of privilege requirements mean attackers can launch campaigns broadly. Prioritize this based on whether CAS authentication is actively deployed; if it is, treat this as HIGH priority for patching. Organizations should not delay upgrading past standard patch cycles, as open redirect vulnerabilities in auth flows are actively exploited in the wild.

Risk score, explained

The CVSS 3.1 score of 6.1 reflects a MEDIUM severity vulnerability. The score is driven up by network accessibility (AV:N) and low attack complexity (AC:L), indicating the vulnerability is easy to exploit remotely. The score is tempered by the requirement for user interaction (UI:R)—the victim must click a malicious link—and limited direct impact on confidentiality and integrity of the APISIX system itself (C:L/I:L/A:N). The changed scope (S:C) indicates that the vulnerability can impact resources beyond the vulnerable component, specifically user accounts and downstream services. For security leaders, this means the threat is real and actionable but not an instant showstopper; however, the authentication context elevates practical risk beyond the numeric score.

Frequently asked questions