CVE-2026-124679

UNKNOWN 0.0

Apache APISIX: jwe-decrypt and forward-auth may pass a client-supplied identity header

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

Authentication bypass by spoofing vulnerability in Apache APISIX. On routes using jwe-decrypt with strict: false and a forward_header distinct from the token header an unauthenticated client can supply the value the upstream treats as gateway-decrypted plaintext. Similar can happen when forward-auth is configured with allow_degradation: true, and the auth service is unavailable. This issue affects Apache APISIX: from 3.18.0 through 3.19.0. Users are recommended to upgrade to version 3.20.0, which fixes the issue.

CWE	CWE-290
Vendor	apache software foundation
Product	apache apisix
Published	Nov 13, 2026
Last Updated	Nov 13, 2026

Stay Ahead of the Next One

Get instant alerts for apache software foundation apache apisix

Be the first to know when new unknown vulnerabilities affecting apache software foundation apache apisix are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Apache Software Foundation / Apache APISIX

3.18.0 ≤ 3.19.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

lists.apache.org: https://lists.apache.org/thread/jmktj1o0rrxf1rdbptk0j3c4h0vdws96 openwall.com: http://www.openwall.com/lists/oss-security/2026/11/13/6

Credits

🔍 Siyang Wu shreemaan-abhishek shreemaan-abhishek