Threats tagged 'ghsa-495r-5j65-5hp3'

A vulnerability exists in the openid-connect plugin of Apache APISIX versions prior to 3.12.0. This flaw affects configurations using introspection mode where multiple issuers share the same private key and rely solely on issuer differentiation. An attacker with a valid account on one issuer could potentially authenticate as a user on another issuer. The vulnerability has a medium severity with a CVSS score of 5.3.