A flaw in the default configuration of the cas-auth plugin in Apache APISIX allows an attacker to craft an HTTP request that includes an unsanitized cookie value. The plugin blindly uses this value to build a redirection URL, enabling the attacker to redirect users to untrusted sites and potentially phish for credentials. This vulnerability is a classic open redirect; it does not grant arbitrary code execution or system compromise but can be used as a vector for phishing or credential theft attacks, compromising the confidentiality of user credentials and trust.

Apache APISIX versions 3.0.0 through 3.16.0 are affected. The vulnerability exists where the cas-auth plugin is enabled with its default settings. The affected environment should verify whether the plugin is installed or actively used. All installations of Apache APISIX within the specified version range must be reviewed.

The CVSS score of 2.1 indicates low severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited exploitation evidence. The attack path requires an attacker to influence the cookie sent to the APISIX instance, typically through a crafted request to a protected endpoint that triggers the cas-auth plugin. Given the low complexity and the lack of broader exploitation data, the immediate risk to enterprise systems is low, but phishing campaigns could exploit the redirect to harm users.