CVE-2026-124679

Name of the Vulnerable Software and Affected Versions Apache APISIX versions 3.18.0 through 3.19.0

Description An authentication bypass issue exists where an unauthenticated client can spoof an identity header. This occurs on routes using jwe-decrypt when strict is set to false and a forward header is distinct from the token header, allowing the client to provide a value that the upstream treats as gateway-decrypted plaintext. A similar scenario occurs when forward-auth is configured with allow degradation set to true and the authentication service is unavailable.

Recommendations Upgrade to version 3.20.0.