Apache APISIX Flaw (CVE-2025-46647): Token Issuer Bypass in OpenID Connect Allows Cross-Issuer Access
Ddos 
Apache APISIX, a high-performance and AI-ready API gateway trusted for managing traffic across microservices and LLM-based applications, has been found vulnerable to a token issuer validation flaw in its OpenID Connect plugin. The vulnerability, tracked as CVE-2025-46647, has been rated “Important” in severity and could allow unauthorized cross-issuer access under specific misconfigurations.
“A vulnerability of plugin openid-connect in Apache APISIX… would allow an attacker with a valid account on one of the issuers to log into the other issuer,” the advisory warns.
This vulnerability only impacts deployments that meet all of the following conditions:
- The openid-connect plugin is used in introspection mode.
- The authentication (auth) service connected to the plugin supports multiple issuers.
- These issuers share the same private key, with the system relying solely on the issuer value to distinguish between them.
In such a setup, if issuer validation is not performed correctly, an attacker holding valid credentials with one issuer could reuse their token to gain access to another issuer’s protected resources.
Only users running Apache APISIX versions earlier than 3.12.0 are impacted. The issue stems from improper validation of the token issuer retrieved via the introspection discovery URL within the OpenID Connect plugin.
This flaw could be especially damaging in environments where the same identity provider is used across multiple logical domains—for instance, in multi-tenant enterprise environments or federated cloud architectures.
“This vulnerability will only have an impact if all of the following conditions are met…” the advisory stresses.
The Apache APISIX team has addressed this issue in version 3.12.0. Users are strongly advised to upgrade to 3.12.0 or later to mitigate the risk.
Related Posts:
- Apache APISIX Remote Code Execution Vulnerability Alert
- Apache APISIX Dashboard Unauthorized Access Vulnerability Alert
- Authentication bypass bug in openID connect provider Dex
- Ivanti Connect Secure, Policy Secure and Secure Access Client Affected by Critical Vulnerabilities
Donate