Authentication Bypass Vulnerability in Apache APISIX
CVE-2026-124679

7.8HIGH

Key Information:

Vendor

Apache
Status
Apache Apisix
Vendor
CVE Published:
13 November 2026

What is CVE-2026-124679?

A vulnerability exists in Apache APISIX that allows an unauthenticated client to bypass authentication mechanisms through spoofing. When routes are configured with jwe-decrypt with strict mode set to false, and the forward header differs from the token header, the upstream server may incorrectly handle gateway-decrypted plaintext. This issue is exacerbated when forward-auth is set to allow degradation, permitting unauthenticated access if the authentication service is down. Users are strongly advised to upgrade to version 3.20.0 or later to mitigate potential security risks.

Affected Version(s)

Apache APISIX 3.18.0 <= 3.19.0

References

https://lists.apache.org/thread/jmktj1o0rrxf1rdbptk0j3c4h...
vendor-advisory

CVSS V4

Score:
7.8
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Siyang Wu
shreemaan-abhishek
shreemaan-abhishek
.