CVE-2026-48895

HighCVSS 7.2/10Last modified Jun 23, 2026

Description

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Apache APISIX.

The attacker could manipulate some client headers to perform an open-redirect, to potentially expose the session token.

This issue affects Apache APISIX: from 3.0.0 through 3.16.0.

Users are recommended to upgrade to version 3.17.0, which fixes the issue.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-601

Affected software

No affected versions have been published.

Timeline

Published
Jun 19, 2026
Last modified
Jun 23, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-488967.5Insufficient state checks lead to a vector that allows to bypass 2FA checks.CVE-2026-488977.5Insufficient state checks lead to a vector that allows to bypass 2FA checks.CVE-2026-488989.8An improper access check allows privilege escalation through the com_users batch task.CVE-2026-488999.8An improper access check allows privilege escalation through the com_users batch task.CVE-2026-48907.5A Denial of Service (DoS) vulnerability in the DNSSEC validation of dnsmasq allows remote attackers to cause a denial of service via a craftCVE-2026-489004.3An improper access check allowed low privileged users to edit the task types of existing scheduler tasks.CVE-2026-489017.5The InputFilter::getInstance() method omitted a security sensitive parameter from the instance cache key.CVE-2026-489029.8The password and username reset features created plain http links for https connections if the "Force SSL" flag wasn't explicitly set.CVE-2026-489036.1Inadequate content filtering within the checkAttribute methods leads to XSS vulnerabilities in various components.CVE-2026-489049.8An improper access check allows privelege escalation through the com_users group editing webservice endpoint.CVE-2026-489056.1Lack of input filtering leads to an XSS vector in the HTML filter code.CVE-2026-489068.1The vulnerability in the Tassos Framework Plugin allows users to delete arbitrary files on the affected sites.
CVE-2026-48895: High severity, CVSS 7.2 | Vulnix