Apache APISIX OpenID Connect Plugin Introspection Mode Vulnerability Allowing Cross-Issuer Authentication

A vulnerability exists in the OpenID Connect plugin of Apache APISIX versions prior to 3.12.0, specifically when the plugin is used in introspection mode. This issue arises when the authentication service connected to OpenID Connect serves multiple issuers that share the same private key, relying solely on the issuer differentiation. Under these conditions, an attacker with a valid account on one issuer could potentially log into another issuer.

Impact

Exploitation of this vulnerability would enable an attacker to authenticate to an issuer using credentials from a different issuer, potentially leading to unauthorized access.

Remediation

Users are advised to upgrade to Apache APISIX version 3.12.0 or higher.