CVE-2026-44087 -- CVSS 9.1 Vulnerability Briefing

CVE-2026-44087 | CVSS 9.1 (Critical) | Exploit: No known exploit

What Is It

CVE-2026-44087 is an Insufficient Verification of Data Authenticity vulnerability in Apache APISIX, specifically affecting the openid-connect plugin under its default configuration, which exposes an attack surface for identity spoofing.

Technical Detail

The flaw exists in how the Apache APISIX openid-connect plugin handles identity verification under default settings, failing to adequately validate the authenticity of authentication data presented during the OpenID Connect flow. An attacker can exploit this by crafting or manipulating identity tokens or claims in a way that the plugin accepts as legitimate, effectively spoofing a user identity. The practical impact is an authentication bypass, potentially allowing an attacker to impersonate arbitrary users, including privileged accounts, against services protected by the APISIX gateway.

Exploitation Status

No known exploit exists for this vulnerability at this time. The exploit maturity is currently assessed as zero, meaning no public proof-of-concept code or observed in-the-wild exploitation has been confirmed. This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog as of June 26, 2026. Despite the absence of known exploitation, the critical CVSS score of 9.1 and the nature of the flaw warrant proactive remediation.

Who Is Targeting This

No confirmed threat actor attribution has been established for this vulnerability. Reported (research-inferred, medium confidence): CLEAVER, SEATURTLE, EQUATION, VELVETANT, and LUMINOUSMOTH have been associated with this CVE in threat intelligence reporting, though the basis for these associations and the motivations of these actors in relation to this specific vulnerability remain unknown. These attributions should not be treated as confirmed targeting at this time.

What To Do

Organizations running Apache APISIX with the openid-connect plugin enabled should treat this as a high-priority patch given the critical severity rating and the authentication bypass impact. Apply the latest available patch or upgrade from the Apache APISIX project addressing this CVE as soon as possible. As an interim workaround, review and harden the openid-connect plugin configuration away from default settings, specifically enforcing strict token validation and claim verification options if the plugin documentation supports them. Operators should also audit gateway access logs for anomalous authentication patterns, unexpected identity claims, or repeated token submissions from unusual sources. Disabling the openid-connect plugin entirely is a viable temporary mitigation for deployments where it is not operationally required.