The vulnerability of the authz-casdoor plugin for the Apache APISIX cloud-based API gateway allows a hacker to bypass security restrictions and gain unauthorized access to protected information.

The vulnerability of the authz-casdoor plugin for the Apache APISIX cloud API gateway is related to deficiencies in the authentication process. Exploiting this vulnerability could allow a malicious actor to bypass security restrictions and gain unauthorized access to protected information...

CVE-2026-47339 Apache APISIX: authz-casdoor incorrect session sharing

Incorrect Authorization vulnerability in Apache APISIX. An attacker can capitalise on authz-casdoor plugin under default configuration to authenticate themselves with credentials from a different source. This issue affects Apache APISIX: from 2.14.1 through 3.16.0. Users are recommended to upgrad...

PT-2026-50886

Name of the Vulnerable Software and Affected Versions Apache APISIX versions 2.14.1 through 3.16.0 Description An incorrect authorization issue exists in the authz-casdoor plugin when using the default configuration. This allows an attacker to authenticate using credentials from a different sourc...

CVE-2026-47339: Incorrect Authorization

Incorrect Authorization vulnerability in Apache APISIX. An attacker can capitalise on authz-casdoor plugin under default configuration to authenticate themselves with credentials from a different source. This issue affects Apache APISIX: from 2.14.1 through 3.16.0. Users are recommended to upgrad...