CVE-2026-94212

[Support]

CVE-2026-94212
Improper verification of cryptographic signature vulnerability in Apache APISIX.



Any unauthenticated attacker could impersonate any user on every route protected by the saml-auth plugin under default configuration. This issue affects Apache APISIX: from 3.17.0 through 3.18.0.



Users are recommended to upgrade to version 3.19.0, which fixes the issue.