A cross‑site request forgery flaw exists in the cas‑auth plugin of Apache APISIX when it is deployed with default settings. An attacker can trick a victim into visiting a malicious page that causes the victim’s browser to authenticate to the apisix instance as the attacker’s identity. Any commands or actions the victim performs on upstream services thereafter are recorded as originating from the attacker. The weakness corresponds to CWE‑352.

Apache APISIX versions 3.0.0 through 3.16.0 are affected when the cas‑auth plugin is enabled under its default configuration. The issue is not present in version 3.17.0 or later, which contains the fix.

The CVSS score of 2.1 rates this vulnerability as low severity, and no EPSS score is available. It is not listed in the CISA KEV catalog. The likely attack vector is remote: the attacker delivers a crafted URL or page to the victim, prompting the victim’s browser to issue a request to the cas‑auth endpoint and establish the victim’s session as the attacker’s. Because exploitation relies on user interaction and only affects identity attribution rather than immediate system control, the risk remains low but visibility into misleading audit logs is a concern. Users should therefore follow the vendor’s recommended upgrade promptly.