Skip to content
VulniPulse
Sign inStart free
High7.8Apache Software Foundation Updated

CVE-2026-124679: Authentication bypass by spoofing vulnerability in Apache APISIX

This Apache advisory covers CVE-2026-124679 in Apache APISIX.

Open the Apache advisory

Key facts

Vendor rating
High, CVSS 7.8
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:H/SA:N · base score 7.8, scored by apacheAttack vector: network. Attack complexity: low. Attack requirements: none. Privileges required: none. User interaction: none. Confidentiality impact on the vulnerable system: none. Integrity impact on the vulnerable system: none. Availability impact on the vulnerable system: none. Confidentiality impact on subsequent systems: low. Integrity impact on subsequent systems: high. Availability impact on subsequent systems: none.
Weakness
  • CWE-290 Authentication bypass by spoofing
CISA KEV
Not listed (catalogue checked )
Affected
3.18.0 through 3.19.0.; through 3.19.0
Fixed in
3.20.0
Source published
Source revised
Listed by VulniPulse

Compiled by VulniPulse from the linked sources. How records are collected and checked.

Affected products & platforms

Apache Software FoundationInfra & Gateways

Description

Authentication bypass by spoofing vulnerability in Apache APISIX.

On routes using jwe-decrypt with strict: false and a forward_header distinct from the token header an unauthenticated

client can supply the value the upstream treats as gateway-decrypted plaintext.

Similar can happen when forward-auth is configured with allow_degradation: true, and the auth service is unavailable.

This issue affects Apache APISIX: from 3.18.0 through 3.19.0.

Users are recommended to upgrade to version 3.20.0, which fixes the issue.

Text from the source record.

Affected versions
  • 3.18.0 through 3.19.0.
  • through 3.19.0

Official advisory · high-confidence parse· fetched ·verify at source

How to fix CVE-2026-124679

Upgrade to a fixed release named by Apache:

  • 3.20.0

Vendor guidance

  • Users are recommended to upgrade to version 3.20.0, which fixes the issue.

More Apache Software Foundation advisories

Apache Software Foundation advisories, November 2026All Apache Software Foundation advisories

Get an email when Apache Infra (APISIX/Traffic Server/CloudStack) publishes the next one.

See Apache Infra (APISIX/Traffic Server/CloudStack)'s last 90 days first. Live alerts for one product are free for life; every vendor is US$15 a month after a free month.

Alert me about Apache Infra (APISIX/Traffic Server/CloudStack)