Apache APISIX allows an attacker to authenticate using credentials sourced from a different account when the cas-auth plugin is enabled on a route. This flaw permits unauthorized users to gain access that they should not possess, compromising confidentiality and potentially enabling further malicious actions. The weakness is classified as Authentication Bypass or Failure, matching CWE-287.

The vulnerability impacts Apache Software Foundation's Apache APISIX from version 3.0.0 up to and including 3.16.0. Any deployment of these versions that utilizes the cas-auth plugin is susceptible, regardless of whether the plugin is used for internal or external traffic.

The CVSS score for this flaw is 5.3, indicating a moderate impact. Because the EPSS score is not available, no current evidence of active exploitation exists, and the vulnerability is not listed in CISA’s KEV catalog. However, exploitation is straightforward if the plugin is enabled: an attacker needs only to send authentication requests through the affected route with credentials from another source. The attack does not require elevated privileges or special preconditions beyond access to the API gateway’s configured routes.