CVE-2026-31923

Apache APISIX: Openid-connect `tls_verify` field is disabled by default

Résumé

Apache APISIX: Openid-connect tls_verify field is disabled by default

Description d'origine

La description telle que publiée par la source (souvent en anglais).

Cleartext Transmission of Sensitive Information vulnerability in Apache APISIX.

This can occur due to ssl_verify in openid-connect plugin configuration being set to false by default.
This issue affects Apache APISIX: from 0.7 through 3.15.0.

Users are recommended to upgrade to version 3.16.0, which fixes the issue.

Source: OSV.dev (Open Source Vulnerabilities) NVD OSV

Paquets affectés

Bitnami apisix

[{"type":"SEMVER","events":[{"introduced":"0.7.0"},{"fixed":"3.16.0"}]}]

Références

advisory openwall.com
advisory lists.apache.org
web nvd.nist.gov