CVE-2025-46647: 
Apache APISIX vulnerability analysis and mitigation

CVE-2025-46647 is an authentication bypass vulnerability in the openid-connect plugin of Apache APISIX, classified as "improper validation of issuer from introspection discovery URL" (CWE-302: Authentication Bypass by Assumed-Immutable Data). It affects all Apache APISIX versions before 3.12.0 and was publicly disclosed on July 2, 2025, by reporter Tiernan Messmer via the Apache security mailing list. The vulnerability carries a CVSS v3.1 base score of 5.3 (Medium), though it is estimated as High severity under certain conditions (Apache OSS-Sec, Feedly).

The root cause is improper validation of the issuer field obtained from the OpenID Connect introspection discovery URL (CWE-302). When the openid-connect plugin operates in introspection mode and the backend authentication service serves multiple issuers that share the same private key — differentiating tenants only by issuer identifier — APISIX fails to adequately verify that the issuer in the token matches the expected issuer for the target resource. This allows a token issued by one issuer to be accepted as valid for another issuer sharing the same key material. Exploitation requires three simultaneous conditions: (1) the plugin is configured in introspection mode, (2) the auth service serves multiple issuers, and (3) those issuers share a private key (Apache OSS-Sec, Feedly).

A successful exploit allows an attacker with a valid account on one OpenID Connect issuer to authenticate as a user on a different issuer served by the same backend auth service, effectively achieving unauthorized cross-issuer access. The primary impact is a confidentiality breach (CVSS C:H), as the attacker can access resources and data belonging to the other issuer's tenant without authorization. Integrity and availability are not directly impacted, but unauthorized access could enable lateral movement across authentication domains in multi-tenant deployments (Apache OSS-Sec, SecurityOnline).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation as of the disclosure date (Feedly). The EPSS score is approximately 0.018% (0.000180), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is constrained by the high-complexity preconditions — specifically, the requirement for a shared private key across multiple issuers — which significantly limits the attack surface (Feedly).

1. Reconnaissance: Identify an Apache APISIX deployment (versions before 3.12.0) using the openid-connect plugin in introspection mode, where the backend auth service serves multiple issuers sharing the same private key.
2. Obtain a valid token: Register or authenticate with a legitimate account on one of the issuers (Issuer A) to obtain a valid JWT or access token signed with the shared private key.
3. Craft cross-issuer request: Submit the token obtained from Issuer A to an APISIX route protected by Issuer B's context, relying on APISIX's failure to validate the issuer claim against the expected issuer for that route.
4. Bypass authentication: Because APISIX does not properly validate the issuer field from the introspection discovery URL, the token from Issuer A is accepted as valid for Issuer B's protected resources.
5. Access unauthorized resources: Gain access to Issuer B's protected APIs, data, or services without a legitimate account on Issuer B (Apache OSS-Sec, SecurityOnline).

• Logs: APISIX access logs showing successful authentication to routes associated with one issuer using tokens whose iss (issuer) claim does not match the expected issuer for that route; repeated cross-issuer token introspection requests in auth service logs.
• Network: Unusual patterns of API requests to APISIX routes from accounts that are not registered with the issuer configured for those routes; introspection endpoint calls with tokens from unexpected issuers.
• Application Behavior: Successful API responses returned to users whose identity tokens originate from a different issuer than the one configured for the accessed route, indicating issuer validation was bypassed.

The primary remediation is to upgrade Apache APISIX to version 3.12.0 or higher, which includes a fix for improper issuer validation in the openid-connect plugin (Apache OSS-Sec). As a configuration-based workaround, administrators should ensure that each authentication issuer uses a unique private key, eliminating the shared-key condition required for exploitation. Additionally, organizations should audit their openid-connect plugin configurations to confirm introspection mode is only used where necessary, and implement supplementary authentication controls beyond the plugin alone (Feedly).

The vulnerability was covered by several security news outlets including GBHackers, SecurityOnline, and CyberPress, which highlighted the cross-issuer access risk under specific misconfiguration scenarios (GBHackers, SecurityOnline). Red Hat also tracked the advisory, indicating relevance to downstream consumers of Apache APISIX (Red Hat). Community reaction has been measured, noting that the vulnerability's impact is limited by its narrow preconditions, particularly the requirement for shared private keys across issuers.