CVE-2026-124666
Apache APISIX: Multi-auth preserves client-supplied Wolf identity headers
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
Authentication bypass by spoofing vulnerability in Apache APISIX. On a route where multi-auth falls back from wolf-rbac to another successful authenticator, client-supplied Wolf identity headers can remain in the request. A downstream service that relies on those documented headers may therefore receive an identity that was not established by the successful authenticator. This issue affects Apache APISIX: from 3.8.0 through 3.19.0. Users are recommended to upgrade to version 3.20.0, which fixes the issue.
| CWE | CWE-290 |
| Vendor | apache software foundation |
| Product | apache apisix |
| Published | Nov 13, 2026 |
| Last Updated | Nov 13, 2026 |
Stay Ahead of the Next One
Get instant alerts for apache software foundation apache apisix
Be the first to know when new unknown vulnerabilities affecting apache software foundation apache apisix are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Apache Software Foundation / Apache APISIX
3.8.0 ≤ 3.19.0
References
Credits
🔍 Ziyue shreemaan-abhishek shreemaan-abhishek