https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 13 Nov 2026 20:24:56 +0000 https://db.gcve.eu/vuln/cve-2026-124679 <p><strong>Affected:</strong> Apache Software Foundation Apache APISIX</p> <p>Authentication bypass by spoofing vulnerability in Apache APISIX.</p> <p>On routes using jwe-decrypt with strict: false and a forward_header distinct from the token header an unauthenticated client can supply the value the upstream treats as gateway-decrypted plaintext. Similar can happen when forward-auth is configured with allow_degradation: true, and the auth service is unavailable.</p> <p>This issue affects Apache APISIX: from 3.18.0 through 3.19.0.</p> <p>Users are recommended to upgrade to version 3.20.0, which fixes the issue.</p> <p><strong>Affected:</strong> Apache Software Foundation Apache APISIX</p> <p>Authentication bypass by spoofing vulnerability in Apache APISIX.</p> <p>On routes using jwe-decrypt with strict: false and a forward_header distinct from the token header an unauthenticated client can supply the value the upstream treats as gateway-decrypted plaintext. Similar can happen when forward-auth is configured with allow_degradation: true, and the auth service is unavailable.</p> <p>This issue affects Apache APISIX: from 3.18.0 through 3.19.0.</p> <p>Users are recommended to upgrade to version 3.20.0, which fixes the issue.</p> https://db.gcve.eu/vuln/cve-2026-124679