CVE-2025-46647

Apache APISIX (versions prior to 3.12.0 ) is vulnerable to an authentication bypass in the openid-connect plugin when used in introspection mode . The root cause is an improper validation of the issuer from the introspection discovery URL, specifically when an auth service provides services to mu...