Cross-route authentication via unbound shared session cookie

Incorrect authorization in Apache APISIX 2.14.1 through 3.16.0 allows remote authenticated users to cross route authentication boundaries. The plugin opened the same default resty.session cookie for every route and accepted any session containing an access_token without binding it to the configured client_id. Exploitation requires an authenticated session for one authz-casdoor route and a second route on the same host using a different Casdoor client; the reused cookie grants access to the second route.