CVE-2026-49872

CVE-2026-49872 involves an improper authentication flaw in the Apache APISIX cas-auth plugin. When the plugin is used in a route, an attacker may authenticate using credentials from a different source, potentially bypassing proper identity checks. Affected versions are 3.0.0 through 3.16.0 of API...