This vulnerability involves the cleartext transmission of sensitive information in Apache APISIX due to the openid-connect plugin's ssl_verify configuration defaulting to false. This setting can lead to insecure communication channels, exposing sensitive data during transmission. The affected versions range from 0.7 through 3.15.0. The Apache Software Foundation has addressed this issue in version 3.16.0 by changing the default configuration or fixing the underlying cause.

Sensitive information may be exposed during transmission if the ssl_verify option remains disabled, increasing the risk of interception or eavesdropping. This could compromise confidentiality but does not inherently indicate remote code execution or privilege escalation. No known exploits in the wild have been reported at this time.

Users should upgrade Apache APISIX to version 3.16.0 or later, where this vulnerability is fixed. Until upgrading, users should manually enable ssl_verify in the openid-connect plugin configuration to ensure encrypted transmission of sensitive information. Patch status is not explicitly confirmed beyond the recommendation to upgrade; therefore, check the vendor advisory for the latest remediation guidance.