https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-11-13T20:24:56.954568+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/cve-2026-124679 CVE-2026-124679 — Apache APISIX: jwe-decrypt and forward-auth may pass a client-supplied identity header 2026-11-13T20:24:56.956171+00:00

Affected: Apache Software Foundation Apache APISIX

Authentication bypass by spoofing vulnerability in Apache APISIX.

On routes using jwe-decrypt with strict: false and a forward_header distinct from the token header an unauthenticated client can supply the value the upstream treats as gateway-decrypted plaintext. Similar can happen when forward-auth is configured with allow_degradation: true, and the auth service is unavailable.

This issue affects Apache APISIX: from 3.18.0 through 3.19.0.

Users are recommended to upgrade to version 3.20.0, which fixes the issue.