CVE-2026-48895: 
Apache APISIX vulnerability analysis and mitigation

CVE-2026-48895 is an open redirect vulnerability (CWE-601) in Apache APISIX, a cloud-native API gateway. An attacker can manipulate client-controlled headers — specifically the Host header used by the CAS authentication plugin — to redirect users to an untrusted site and potentially expose their session tokens. The vulnerability affects Apache APISIX versions 3.0.0 through 3.16.0 and was publicly disclosed on June 18–19, 2026. It carries a CVSS v3.1 base score of 7.2 (High) and a CVSS v4.0 base score of 2.1 (Low), reflecting the requirement for user interaction in the v4.0 model (Apache Advisory, GitHub Advisory, OSS-Sec).

The root cause is improper validation of client-supplied HTTP headers within Apache APISIX's CAS (Central Authentication Service) authentication plugin (CWE-601: URL Redirection to Untrusted Site). Specifically, the cas-auth plugin uses the HTTP Host header to construct the CAS service URL for redirects without adequately sanitizing or validating the header value. An unauthenticated remote attacker can craft a request with a manipulated Host header, causing APISIX to redirect authenticated users to an attacker-controlled domain. The attack requires no privileges but does require that a victim user interact with the crafted request (e.g., follow a link), and attack requirements include specific deployment conditions related to the CAS plugin being enabled (OSS-Sec, GitHub Advisory).

Successful exploitation allows an attacker to redirect authenticated users to a malicious site, where session tokens transmitted as part of the redirect URL could be harvested. This primarily affects confidentiality (session token exposure) and integrity (spoofing/phishing via trusted domain redirect), with no direct availability impact. The scope is changed in CVSS v3.1 terms, meaning the impact extends beyond the vulnerable APISIX instance to downstream users and systems that trust the redirected session (GitHub Advisory, Apache Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of disclosure (Apache Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.298–0.409%, placing it in the lower percentiles for near-term exploitation likelihood. NVD's SSVC assessment also classifies exploitation as "none" and the vulnerability as non-automatable, reflecting the requirement for active user interaction (GitHub Advisory).

1. Reconnaissance: Identify Apache APISIX deployments (versions 3.0.0–3.16.0) with the cas-auth plugin enabled, using network scanning tools or by probing API gateway endpoints for CAS authentication redirects.
2. Craft malicious Host header: Prepare an HTTP request targeting the APISIX CAS authentication endpoint with a manipulated Host header pointing to an attacker-controlled domain (e.g., Host: attacker.example.com).
3. Deliver the crafted request: Distribute a link or embed a request that causes a victim user to trigger the APISIX CAS redirect flow with the manipulated header — for example, via a phishing email or malicious web page.
4. Capture session token: When the victim follows the redirect, APISIX constructs the CAS service URL using the attacker-supplied Host value, redirecting the user (and their session token) to the attacker's server, where the token can be logged and captured.
5. Session hijacking: Use the captured session token to impersonate the victim user against the protected application (OSS-Sec, GitHub Advisory).

• Network: Outbound HTTP redirects from the APISIX gateway to unexpected or external domains not in the configured trusted list; HTTP 302 responses with Location headers pointing to non-organizational domains.
• Logs: APISIX access logs showing requests to CAS authentication endpoints with anomalous or external Host header values; repeated redirect responses to the same external domain from multiple source IPs.
• Application: CAS service URL parameters in redirect logs containing external hostnames rather than the expected internal APISIX hostname; session tokens appearing in server logs of external/unknown hosts (if log aggregation is in place).

Users should upgrade Apache APISIX to version 3.17.0, which contains the fix for this vulnerability (Apache Advisory). For deployments where immediate patching is not feasible, implement server-side validation and sanitization of all client-controlled headers (particularly the Host header) used in redirect construction, and restrict redirect destinations to a whitelist of trusted domains. Additionally, consider placing APISIX behind a reverse proxy or load balancer that enforces a fixed Host header to prevent client manipulation.

The vulnerability was reported by researcher "lokerxxx" and disclosed by Abhishek Choudhary of Apache on the oss-security mailing list on June 19, 2026 (OSS-Sec). Community reaction has been limited, consistent with the moderate severity and lack of active exploitation. A brief mention appeared on Bluesky's infosec community shortly after disclosure, and the advisory was picked up by standard vulnerability aggregators including Vulners, VulDB, and OSV (GitHub Advisory).