CVE-2026-31923
Cleartext Transmission of Sensitive Information vulnerability in Apache APISIX. This can occur due to `ssl_verify` in openid-connect plugin configuration being set to false by default. This issue affects Apache APISIX: from 0.7 through 3.15.0. Users are recommended to upgrade to version 3.16.0, which fixes the issue.
- CVSS 3.1
- 7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - EPSS
- 0.2% chance of exploitation in the next 30 days; higher than 16% of CVEs (scores of 2026-10-26)
- CWE
- CWE-319
- Published
- Modified
- Record from
- the NVD, synced
Affected
- apache:apisix