PT-2026-50887 · Apache · Apache Apisix

Leon

·

CVE-2026-47341

·

Published

2026-06-19

·

Updated

2026-06-23

CVSS v3.1

6.5

Medium

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions Apache APISIX versions 3.11.0 through 3.16.0
Description An authentication bypass exists due to a capture-replay issue. An attacker can leverage specific configurations in the hmac-auth module to reuse a token indefinitely, effectively bypassing the token expiry mechanism.
Recommendations Upgrade to version 3.17.0.

Exploit

Fix

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-294

Related Identifiers

BIT-APISIX-2026-47341
CVE-2026-47341

Affected Products

Apache Apisix